Using Automation and AI for Detection Engineering and Incident Response GASAE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is integrating an AI-based detection tool with its existing SOAR platform. The AI tool identifies potential threats and the SOAR platform is used to execute response playbooks. The team wants to ensure that the AI tool's output is effectively used by the SOAR platform. What is the most important integration point to configure?

   • ASet up a schedule for the AI tool to run and send its output to the SOAR platform once a day.
   • BEnsure the AI tool and the SOAR platform are hosted on the same network segment.
   • CMap the AI tool's output fields (e.g., threat type, confidence score, affected assets) to the SOAR platform's alert data model.
   • DConfigure the AI tool to send its output as a PDF report to the SOAR platform's email address.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An organization is integrating an AI-based alert enrichment tool into their incident response workflow. The tool adds threat intelligence context to alerts, but it sometimes enriches alerts with irrelevant or outdated information. The team wants to ensure that the enrichment is useful and does not mislead analysts. What is the best way to handle this?

   • AAutomatically remove any enrichment that is older than 24 hours.
   • BImplement a feedback mechanism where analysts can rate the usefulness of enrichment, and use that feedback to tune the tool's algorithms.
   • COnly use enrichment from a single trusted threat intelligence source.
   • DDisable the enrichment feature and rely on manual threat intelligence lookups.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has an automated playbook that responds to a specific type of alert. The playbook's first step is to automatically isolate the affected host from the network. The second step is to automatically run a set of forensic commands. The security team is concerned that the forensic commands are too intrusive and could disrupt the host's operations if the alert is a false positive. They also want to ensure that the response is fast enough to contain a real threat. What is the best way to modify the playbook to address these concerns?

   • ARemove the forensic collection step from the playbook entirely and only isolate the host.
   • BKeep the automatic isolation step, but change the forensic collection step to require a human analyst to approve it before it runs.
   • CKeep the automatic forensic collection step, but change the isolation step to require a human analyst to approve it.
   • DKeep both steps automatic but add a step that automatically reverses the isolation if the forensic collection finds no evidence of compromise.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An organization is integrating an AI-based incident response assistant into their SOAR platform. The assistant can suggest response actions, but the team is concerned about the assistant making mistakes. They want to ensure that the assistant's suggestions are safe and effective. What is the best way to implement this integration?

   • AUse the assistant only for documentation and reporting, not for suggesting actions.
   • BDeploy the assistant in a test environment for a month and then enable automatic execution.
   • CUse a human-in-the-loop model where the assistant suggests actions, but an analyst must approve each action before it is executed.
   • DAllow the assistant to execute actions automatically for high-confidence suggestions only.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team maintains a large repository of Sigma rules. They want to automate the detection engineering lifecycle so that new rules are validated against a set of known-good and known-bad events before being deployed to production SIEMs. Which approach best uses automation and AI to achieve this while minimizing manual review effort?

   • ARun a one-time batch test of all rules against the event corpus and then disable any rule that produces false positives.
   • BUse a CI/CD pipeline that runs a rule-testing harness against the event corpus, and use an AI model to suggest rule refinements when tests fail.
   • CDeploy all new rules directly to production and rely on alert volume metrics to identify problematic rules.
   • DHave a senior analyst manually review each rule and then push it to production using a script that copies the rule file.
   Reveal Solution Discussion Select an answer first