Using Automation and AI for Detection Engineering and Incident Response GASAE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to automate the testing of new detection rules before they are deployed to production. They have a staging environment that mirrors the production SIEM. Which approach best automates the testing process while ensuring the rules are validated against realistic data?

   • AManually copy each new rule to the staging environment and run a few sample queries to see if it returns results.
   • BCreate a CI/CD pipeline that automatically deploys new rules to the staging environment, runs them against a replay of production traffic, and reports the results.
   • CDeploy the rules directly to production but in a 'monitor only' mode that does not alert, and review the logs after a week.
   • DHave the AI model that generates the rules also validate them by checking the syntax and logic.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which action is most appropriate to include in an automated playbook for a confirmed malware infection on an endpoint?

   • ASend an email to the entire organization about the infection
   • BImmediately reimage the endpoint without preserving any data
   • CIsolate the endpoint from the network and collect forensic artifacts
   • DWait for the user to report the issue before taking any action
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a primary way AI models assist in creating new detection rules?

   • ABy analyzing large volumes of telemetry to identify anomalous patterns that could indicate novel threats
   • BBy ensuring that all new rules have zero false positives
   • CBy automatically writing rules in a natural language format that requires no testing
   • DBy replacing the need for threat intelligence feeds entirely
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which metric is most useful for evaluating the performance of an automated detection system?

   • AThe number of detection rules written by the team
   • BThe false positive rate of generated alerts
   • CThe time taken to write a new detection rule
   • DThe total number of alerts generated per day
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a key consideration when integrating an AI-based alert enrichment tool into an existing incident response workflow?

   • AEnsuring the AI tool stores all data in a separate isolated network with no connectivity
   • BReplacing the existing SIEM entirely with the AI tool
   • CDisabling all manual analyst actions to ensure the AI tool is used
   • DEnsuring the tool can consume data from existing SIEM and ticketing systems through supported APIs
   Reveal Solution Discussion Select an answer first