Using Automation and AI for Detection Engineering and Incident Response GASAE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which benefit is most directly achieved by automating the testing of detection rules in a staging environment?

   • ADetection rules are automatically written based on the latest threat intelligence feeds
   • BRules can be validated against known attack samples before production deployment, reducing false positives and false negatives
   • CAll detection rules are guaranteed to have zero false positives in production
   • DThe need for human analysts to review any detection rule is eliminated
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does AI-driven triage primarily help reduce false positives in incident response?

   • ABy deleting all alerts that are not manually confirmed by an analyst
   • BBy increasing the volume of alerts sent to the security team
   • CBy automatically correlating alerts with threat intelligence and historical data to assign a confidence score
   • DBy automatically blocking all IP addresses that appear in any alert
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is an effective way to improve an automated incident response system based on feedback?

   • AReviewing post-incident reports to identify steps that failed or were skipped, then updating the playbook accordingly
   • BDeleting all playbooks that have ever failed and writing new ones from scratch
   • CIncreasing the automation speed to reduce response time regardless of accuracy
   • DDisabling all automated actions and reverting to manual processes
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team has deployed an automated incident response playbook that contains a host and blocks an IP address. After a month, they review the playbook's performance and find that it has a high false positive rate, causing unnecessary host isolation. They want to reduce the false positives without losing the ability to respond to real incidents. What is the best approach?

   • ADisable the playbook and rely on manual response.
   • BAdd a confirmation step to the playbook that requires an AI model to verify the alert's confidence before executing the containment actions.
   • CIncrease the severity threshold for triggering the playbook.
   • DRemove the automated containment actions and require manual approval for every incident.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A detection engineering team wants to automate the testing of new detection rules. They have a large corpus of historical security events, but the corpus is imbalanced: it contains many more benign events than malicious events. What is the best way to evaluate the rules' performance?

   • AUse accuracy as the primary metric, since it is easy to understand.
   • BUse precision and recall as primary metrics, and consider the baseline false positive rate when interpreting the results.
   • CUse the F1 score, but only if the dataset is balanced.
   • DUse only the true positive rate to evaluate the rules.
   Reveal Solution Discussion Select an answer first