Security Automation Fundamentals GASAE Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A security team automates the blocking of IP addresses that trigger more than 10 failed login attempts in 5 minutes. The automation is effective against brute-force attacks, but it has blocked a legitimate partner's IP because the partner's system uses a shared NAT gateway. The team wants to keep the automation but avoid blocking the partner. Which solution best addresses this conflict?

   • ARaise the threshold to 50 failed attempts in 5 minutes to reduce false positives.
   • BAutomate the block but require a human analyst to approve each block before it is applied.
   • CAdd the partner's IP to an allowlist so the automation never blocks it.
   • DUse a different detection method, such as requiring failed attempts from multiple usernames, to reduce false positives.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC deploys an automated alert-triage rule that quarantines endpoints when the EDR detects a suspicious file. Within the first week, the rule quarantines several endpoints that later turn out to be running a legitimate internal application. The team wants to reduce these disruptions while keeping the automation for genuine threats. Which change is the most appropriate first step?

   • AChange the rule to quarantine only when the file hash matches a known-malicious list.
   • BAdd an exception list for the legitimate application and require a secondary verification step before quarantine.
   • CRemove the automated quarantine action and require a human analyst to manually quarantine every endpoint.
   • DIncrease the frequency of the automated rule so it runs more often and catches threats faster.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security team has separate automated scripts: one that collects IOCs from a threat feed, one that checks endpoints for those IOCs, and one that sends an alert if a match is found. The scripts work, but the team wants to manage them as a single coordinated workflow with error handling and a defined sequence. What should they implement?

   • AA new script that runs the three existing scripts in sequence and stops on the first error.
   • BAn orchestration platform that defines the workflow, handles retries, and provides a single dashboard for the entire process.
   • CA shared folder where each script drops its output and the next script picks it up.
   • DA cron job that runs all three scripts at the same time every day.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security operations team is considering implementing automation for their incident response process. They currently have a well-documented manual process that works well but is slow. What is the primary value proposition of automating this process?

   • AIt will reduce the time to respond to incidents and ensure that the response steps are performed consistently every time.
   • BIt will eliminate the need for human analysts to be involved in incident response entirely.
   • CIt will guarantee that no security incident will ever be missed by the security team.
   • DIt will automatically identify and fix the root cause of every security incident.
   Reveal Solution Discussion Select an answer first