Using Automation and AI for Detection Engineering and Incident Response GASAE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A detection engineering team has deployed an AI model that generates detection rules. They want to evaluate whether the model is producing useful rules. Which metric is most appropriate for this evaluation?

   • AThe number of rules generated per hour.
   • BThe total number of rules in the repository after one month.
   • CThe model's training accuracy on the historical dataset.
   • DThe percentage of generated rules that pass validation and are deployed to production.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security operations center (SOC) receives thousands of alerts daily. The team wants to automate the initial response for high-confidence alerts while ensuring that low-confidence alerts are still reviewed by analysts. They plan to build a playbook that runs when an alert is triggered. What is the best design for this playbook?

   • AAutomatically block the source IP for every alert that has a severity of 'high'.
   • BUse an AI model to score each alert's confidence; if the score is above a threshold, automatically execute containment actions; otherwise, route the alert to a human analyst queue.
   • CSend all alerts to analysts and only automate the creation of a ticket.
   • DAutomatically contain every alert that matches a known signature, regardless of confidence.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a detection engineering workflow, which task is most directly improved by automating the deployment phase?

   • AEnsuring that new detection rules are consistently pushed to all relevant sensors and platforms without manual steps
   • BWriting the initial detection logic from scratch based on a new vulnerability disclosure
   • CInterpreting the business context of a new threat intelligence report to decide if a rule is needed
   • DDetermining the root cause of a security incident after detection
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which practice best supports the integration of automation into an existing incident response workflow?

   • AAutomating all response actions immediately, including destructive ones, to maximize efficiency
   • BStarting with low-risk, repetitive tasks such as alert enrichment and ticket creation
   • CAvoiding any changes to existing processes to prevent disruption
   • DReplacing the entire incident response team with automated systems
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A detection engineering team is using an AI model to generate new detection rules. The model is trained on a dataset of past attacks and is producing a high number of rules. However, when the team evaluates the rules against a separate test dataset, they find that many of the rules have a high false positive rate. The team suspects the model is overfitting to the training data. Which approach is most likely to reduce the false positive rate of the generated rules?

   • AManually review each generated rule and remove any that seem too specific to a particular attack pattern.
   • BIncrease the complexity of the AI model so it can learn more intricate patterns in the training data.
   • CDecrease the amount of training data to make the model simpler and less likely to overfit.
   • DIncrease the amount of training data by including more diverse examples of benign network traffic.
   Reveal Solution Discussion Select an answer first