Security Automation Fundamentals GASAE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security team automates the creation of firewall rules to block IP addresses that trigger repeated brute-force attempts. After deployment, they notice that the automation sometimes blocks a legitimate partner's IP because the partner's system retries a few times. The team wants to keep the automation but reduce the impact of these false blocks. Which adjustment best balances the automation benefit with the risk?

   • ARequire a higher threshold of failed attempts before the automation blocks an IP.
   • BAutomate the block but do not log the actions to reduce alert noise.
   • CRemove the automation and have analysts manually block IPs after reviewing each alert.
   • DBlock the IP for a longer duration to prevent the partner from retrying.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security team needs to demonstrate compliance with an internal policy that requires all firewall changes to be reviewed and approved by a senior engineer. The team wants to automate the submission and tracking of change requests. Which use of automation best supports this compliance requirement?

   • AAutomate the firewall change and generate a report after the change is applied.
   • BAutomate the creation of a change ticket, but require the senior engineer to approve before the change is executed.
   • CAutomate the approval by having the system send an email to the senior engineer after the change is done.
   • DAutomate the change and log the senior engineer as the approver without their interaction.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   How does security automation reduce human error in security operations?

   • ABy eliminating the need for human oversight of automated processes
   • BBy performing tasks in a uniform manner without fatigue or lapses in attention
   • CBy ensuring that all security alerts are false positives and can be safely ignored
   • DBy automatically rewriting security policies based on the latest threat intelligence
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team wants to automate compliance evidence collection for an audit. The audit requires that evidence be collected from multiple systems, timestamped, and stored in a tamper-evident manner. The team wants to reduce manual effort but must ensure the evidence is admissible. Which automation approach best meets these requirements?

   • AAutomate the collection and email the evidence to the auditor directly.
   • BAutomate the collection from all systems, but have an analyst manually timestamp and store the evidence.
   • CAutomate the collection, timestamping, and storage in a write-once, read-many (WORM) storage system.
   • DAutomate the collection but store the evidence in a shared folder with analyst-controlled permissions.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a common challenge when implementing security automation?

   • AAutomation always increases the number of security incidents
   • BAutomation can generate false positives, overwhelming analysts with alerts
   • CAutomation eliminates the need for security analysts, leading to job losses
   • DAutomation is only useful for large enterprises and cannot be scaled to smaller organizations
   Reveal Solution Discussion Select an answer first