Develop Complex/cross Platform Automation to Orchestrate Workflows for Cybersecurity Operations Such as Investigation, Detection, and Incident Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the main purpose of incident response automation?

   • ATo replace the incident response team with automated scripts.
   • BTo generate reports for compliance without any action on the incident.
   • CTo automate the entire incident response process without any human involvement.
   • DTo orchestrate automated steps for containment, eradication, recovery, and reporting to speed up response and reduce manual effort.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team needs to automate the collection of Windows Event Logs and Linux syslog data from multiple servers for investigation. The automation script will run on a central Linux server and must work across both Windows and Linux targets. The team uses PowerShell for Windows and Bash for Linux. Which approach ensures the script is cross-platform and maintainable?

   • AUse a PowerShell script that runs on the central Linux server via PowerShell Core.
   • BUse a Bash script that remotely executes PowerShell commands on Windows via SSH.
   • CWrite two separate scripts: one in PowerShell for Windows and one in Bash for Linux, and run them from the central server.
   • DWrite a single Python script that uses platform-specific modules to collect logs from both Windows and Linux.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of integrating automation with a security tool via an API?

   • AA security team uses a shared spreadsheet to track incidents.
   • BA script that manually copies logs from a server to a USB drive.
   • CAn analyst manually enters data into a ticketing system.
   • DA playbook that automatically sends a request to a firewall's API to block an IP address.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which scenario best illustrates the application of cross-platform automation in cybersecurity operations?

   • AA firewall blocks traffic based on static rules configured by an administrator.
   • BA script runs only on Windows servers to collect event logs and sends them to a SIEM.
   • CA security analyst manually reviews logs from different servers in separate consoles.
   • DA playbook automatically queries indicators of compromise across Windows, Linux, and cloud APIs, then enriches them in a single workflow.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following tasks is most suitable for automation in a security investigation?

   • AInterviewing employees who may have been involved in a security incident.
   • BDetermining the intent of an attacker based on the context of the attack.
   • CDeciding whether to escalate an incident to law enforcement.
   • DCollecting logs from multiple sources and correlating them based on IP addresses and timestamps.
   Reveal Solution Discussion Select an answer first