Topic 20 Practice Test 1 covers Security Automation and Orchestration for CompTIA Security+ SY0-701 and maps to objective 4.7: Explain the importance of automation and orchestration related to secure operations. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
The control set for a security-automation engineering review must address both automated security checks integrated into software build and delivery pipelines and operational risk created when automated workflows become difficult to understand, test, or troubleshoot. Which TWO choices map directly to those needs? Choose TWO.
- Automated ticket creation
- Continuous integration security testing
- Automation complexity risk
- Automated service disablement
- Single-point-of-failure risk
Correct Answers: B, C
Correct Answers
Answer B is correct because Continuous integration security testing means automated security checks integrated into software build and delivery pipelines. It belongs in the fixed-count answer set because it covers one of the stated requirements. Automated service disablement instead serves workflow that disables accounts, services, or access when risk conditions are met and cannot replace this function.
Answer C is correct because Automation complexity risk means operational risk created when automated workflows become difficult to understand, test, or troubleshoot. The fixed-count item needs this function in the answer set. Single-point-of-failure risk covers risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails, a different requirement.
Incorrect Answers
Answer A is incorrect because Automated ticket creation means generation of service or incident records directly from monitoring or workflow events. The required choices are Automation complexity risk, Continuous integration security testing. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Automated service disablement means workflow that disables accounts, services, or access when risk conditions are met. The fixed-count answer set is Automation complexity risk, Continuous integration security testing; this option does not fill one of those named functions.
Answer E is incorrect because Single-point-of-failure risk means risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. The question requires exactly 2 selections: Automation complexity risk, Continuous integration security testing. This option falls outside that required set.
Question 2
Which term describes future maintenance burden created by quick or poorly documented automation choices?
- Automated user provisioning
- Reaction-time benefit
- Technical debt risk
- Automated service disablement
Correct Answer: C
Correct Answer
Answer C is correct because Technical debt risk means future maintenance burden created by quick or poorly documented automation choices. That makes it the best answer here; Automated service disablement addresses workflow that disables accounts, services, or access when risk conditions are met, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers. The concept is valid, but it does not match this stem. The required function is future maintenance burden created by quick or poorly documented automation choices, which maps to Technical debt risk.
Answer B is incorrect because Reaction-time benefit refers to reduction in delay between detection and a predefined response action. This could be appropriate elsewhere, but the required function is future maintenance burden created by quick or poorly documented automation choices; that makes Technical debt risk the precise choice.
Answer D is incorrect because Automated service disablement refers to workflow that disables accounts, services, or access when risk conditions are met. This could be appropriate elsewhere, but the required function is future maintenance burden created by quick or poorly documented automation choices; that makes Technical debt risk the precise choice.
Question 3
The control set for a security-automation engineering review must address both automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service and use of automation to handle repeatable tasks so analysts can focus on higher-value decisions. Which TWO choices map directly to those needs? Choose TWO.
- Workforce-multiplier benefit
- Baseline enforcement benefit
- Single-point-of-failure risk
- Guardrail
- Automated escalation
Correct Answers: A, D
Correct Answers
Answer A is correct because Workforce-multiplier benefit means use of automation to handle repeatable tasks so analysts can focus on higher-value decisions. This selection maps directly to one of the named needs. Automated escalation addresses routing of alerts or tasks to higher-priority responders based on severity, time, or conditions, so it does not satisfy the same slot.
Answer D is correct because Guardrail means an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. This selection maps directly to one of the named needs. Automated escalation addresses routing of alerts or tasks to higher-priority responders based on severity, time, or conditions, so it does not satisfy the same slot.
Incorrect Answers
Answer B is incorrect because Baseline enforcement benefit means automation that repeatedly applies approved configurations and detects or corrects drift. Every answer slot must map to a stated requirement. The correct set is Guardrail, Workforce-multiplier benefit, so this option cannot replace one of those selections.
Answer C is incorrect because Single-point-of-failure risk means risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. Every answer slot must map to a stated requirement. The correct set is Guardrail, Workforce-multiplier benefit, so this option cannot replace one of those selections.
Answer E is incorrect because Automated escalation means routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. Every answer slot must map to a stated requirement. The correct set is Guardrail, Workforce-multiplier benefit, so this option cannot replace one of those selections.
Question 4
Which term describes reduction in delay between detection and a predefined response action?
- Technical debt risk
- Single-point-of-failure risk
- Workforce-multiplier benefit
- Reaction-time benefit
Correct Answer: D
Correct Answer
Answer D is correct because Reaction-time benefit means reduction in delay between detection and a predefined response action. The requirement maps directly to this function, whereas Single-point-of-failure risk is aimed at risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails.
Incorrect Answers
Answer A is incorrect because Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices. The key mismatch is functional: Reaction-time benefit addresses reduction in delay between detection and a predefined response action, the need stated by the question.
Answer B is incorrect because Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. The scenario instead requires reduction in delay between detection and a predefined response action, which is why Reaction-time benefit is the better answer; this option serves the different function defined above.
Answer C is incorrect because Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions. That concept can be valid in another scenario, but this question is testing reduction in delay between detection and a predefined response action; Reaction-time benefit therefore fits the requirement more directly.
Question 5
The control set for a security-automation engineering review must address both creation of infrastructure or services through code, templates, or workflow and routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. Which TWO choices map directly to those needs? Choose TWO.
- Automated ticket creation
- Continuous integration security testing
- Automated resource provisioning
- Automated escalation
- Automated service disablement
Correct Answers: C, D
Correct Answers
Answer C is correct because Automated resource provisioning means creation of infrastructure or services through code, templates, or workflow. This selection maps directly to one of the named needs. Automated service disablement addresses workflow that disables accounts, services, or access when risk conditions are met, so it does not satisfy the same slot.
Answer D is correct because Automated escalation means routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. This option satisfies a specific requirement in the stem; Automated service disablement serves workflow that disables accounts, services, or access when risk conditions are met and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because Automated ticket creation means generation of service or incident records directly from monitoring or workflow events. The fixed-count answer set is Automated resource provisioning, Automated escalation; this option does not fill one of those named functions.
Answer B is incorrect because Continuous integration security testing means automated security checks integrated into software build and delivery pipelines. The scenario calls for Automated resource provisioning, Automated escalation. Selecting this option would leave one of those required functions uncovered.
Answer E is incorrect because Automated service disablement means workflow that disables accounts, services, or access when risk conditions are met. The question requires exactly 2 selections: Automated resource provisioning, Automated escalation. This option falls outside that required set.
Question 6
Which term describes automated security checks integrated into software build and delivery pipelines?
- Continuous integration security testing
- Technical debt risk
- Single-point-of-failure risk
- Workforce-multiplier benefit
Correct Answer: A
Correct Answer
Answer A is correct because Continuous integration security testing means automated security checks integrated into software build and delivery pipelines. That makes it the best answer here; Technical debt risk addresses future maintenance burden created by quick or poorly documented automation choices, not the function requested in the stem.
Incorrect Answers
Answer B is incorrect because Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices. The key mismatch is functional: Continuous integration security testing addresses automated security checks integrated into software build and delivery pipelines, the need stated by the question.
Answer C is incorrect because Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. This could be appropriate elsewhere, but the required function is automated security checks integrated into software build and delivery pipelines; that makes Continuous integration security testing the precise choice.
Answer D is incorrect because Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions. That concept can be valid in another scenario, but this question is testing automated security checks integrated into software build and delivery pipelines; Continuous integration security testing therefore fits the requirement more directly.
Question 7
To identify insecure code or dependencies before release, which security approach should be selected?
- Automated escalation
- Baseline enforcement benefit
- Continuous integration security testing
- Automated user provisioning
Correct Answer: C
Correct Answer
Answer C is correct because Continuous integration security testing means automated security checks integrated into software build and delivery pipelines. The requirement maps directly to this function, whereas Baseline enforcement benefit is aimed at automation that repeatedly applies approved configurations and detects or corrects drift.
Incorrect Answers
Answer A is incorrect because Automated escalation refers to routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. The concept is valid, but it does not match this stem. The required function is automated security checks integrated into software build and delivery pipelines, which maps to Continuous integration security testing.
Answer B is incorrect because Baseline enforcement benefit refers to automation that repeatedly applies approved configurations and detects or corrects drift. The concept is valid, but it does not match this stem. The required function is automated security checks integrated into software build and delivery pipelines, which maps to Continuous integration security testing.
Answer D is incorrect because Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers. The scenario instead requires automated security checks integrated into software build and delivery pipelines, which is why Continuous integration security testing is the better answer; this option serves the different function defined above.
Question 8
Which term describes generation of service or incident records directly from monitoring or workflow events?
- Reaction-time benefit
- Automated ticket creation
- Continuous integration security testing
- Technical debt risk
Correct Answer: B
Correct Answer
Answer B is correct because Automated ticket creation means generation of service or incident records directly from monitoring or workflow events. That is the function the question is testing. Continuous integration security testing would instead be used for automated security checks integrated into software build and delivery pipelines.
Incorrect Answers
Answer A is incorrect because Reaction-time benefit refers to reduction in delay between detection and a predefined response action. The scenario instead requires generation of service or incident records directly from monitoring or workflow events, which is why Automated ticket creation is the better answer; this option serves the different function defined above.
Answer C is incorrect because Continuous integration security testing refers to automated security checks integrated into software build and delivery pipelines. The question is not asking for this function. It is testing generation of service or incident records directly from monitoring or workflow events, so Automated ticket creation is the stronger fit.
Answer D is incorrect because Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices. The key mismatch is functional: Automated ticket creation addresses generation of service or incident records directly from monitoring or workflow events, the need stated by the question.
Question 9
Which term describes programmatic connection between security tools so one system can query or trigger actions in another?
- Workforce-multiplier benefit
- Automated security-group management
- API integration
- Guardrail
Correct Answer: C
Correct Answer
Answer C is correct because API integration means programmatic connection between security tools so one system can query or trigger actions in another. That makes it the best answer here; Workforce-multiplier benefit addresses use of automation to handle repeatable tasks so analysts can focus on higher-value decisions, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Workforce-multiplier benefit refers to use of automation to handle repeatable tasks so analysts can focus on higher-value decisions. The scenario instead requires programmatic connection between security tools so one system can query or trigger actions in another, which is why API integration is the better answer; this option serves the different function defined above.
Answer B is incorrect because Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently. That concept can be valid in another scenario, but this question is testing programmatic connection between security tools so one system can query or trigger actions in another; API integration therefore fits the requirement more directly.
Answer D is incorrect because Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. The concept is valid, but it does not match this stem. The required function is programmatic connection between security tools so one system can query or trigger actions in another, which maps to API integration.
Question 10
To keep teams within defined security boundaries without requiring every action to be manual, which security approach should be selected?
- Guardrail
- Automated resource provisioning
- Automated ticket creation
- Single-point-of-failure risk
Correct Answer: A
Correct Answer
Answer A is correct because Guardrail means an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. The deciding point is functional fit: this option covers the stated need, while Automated resource provisioning addresses creation of infrastructure or services through code, templates, or workflow.
Incorrect Answers
Answer B is incorrect because Automated resource provisioning refers to creation of infrastructure or services through code, templates, or workflow. The question is not asking for this function. It is testing an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service, so Guardrail is the stronger fit.
Answer C is incorrect because Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events. The question is not asking for this function. It is testing an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service, so Guardrail is the stronger fit.
Answer D is incorrect because Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. That concept can be valid in another scenario, but this question is testing an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service; Guardrail therefore fits the requirement more directly.
Question 11
To reduce manual errors and speed controlled onboarding, which security approach should be selected?
- Continuous integration security testing
- Baseline enforcement benefit
- Automated user provisioning
- Automated security-group management
Correct Answer: C
Correct Answer
Answer C is correct because Automated user provisioning means use of scripts, workflows, or identity systems to create accounts and access based on approved triggers. This matches the requirement as written. Baseline enforcement benefit can be valid in another context, but it is used for automation that repeatedly applies approved configurations and detects or corrects drift.
Incorrect Answers
Answer A is incorrect because Continuous integration security testing refers to automated security checks integrated into software build and delivery pipelines. The concept is valid, but it does not match this stem. The required function is use of scripts, workflows, or identity systems to create accounts and access based on approved triggers, which maps to Automated user provisioning.
Answer B is incorrect because Baseline enforcement benefit refers to automation that repeatedly applies approved configurations and detects or corrects drift. This could be appropriate elsewhere, but the required function is use of scripts, workflows, or identity systems to create accounts and access based on approved triggers; that makes Automated user provisioning the precise choice.
Answer D is incorrect because Automated security-group management refers to use of code or workflow to create and update network or cloud access rules consistently. The concept is valid, but it does not match this stem. The required function is use of scripts, workflows, or identity systems to create accounts and access based on approved triggers, which maps to Automated user provisioning.
Question 12
Which term describes workflow that disables accounts, services, or access when risk conditions are met?
- Automated escalation
- Automated service disablement
- Automated ticket creation
- Automated user provisioning
Correct Answer: B
Correct Answer
Answer B is correct because Automated service disablement means workflow that disables accounts, services, or access when risk conditions are met. That makes it the best answer here; Automated user provisioning addresses use of scripts, workflows, or identity systems to create accounts and access based on approved triggers, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Automated escalation refers to routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. The question is not asking for this function. It is testing workflow that disables accounts, services, or access when risk conditions are met, so Automated service disablement is the stronger fit.
Answer C is incorrect because Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events. The question is not asking for this function. It is testing workflow that disables accounts, services, or access when risk conditions are met, so Automated service disablement is the stronger fit.
Answer D is incorrect because Automated user provisioning refers to use of scripts, workflows, or identity systems to create accounts and access based on approved triggers. That concept can be valid in another scenario, but this question is testing workflow that disables accounts, services, or access when risk conditions are met; Automated service disablement therefore fits the requirement more directly.
Question 13
Which automated policy constraint prevents or flags insecure configurations while still allowing approved self-service?
- Reaction-time benefit
- Guardrail
- Automation complexity risk
- Automated service disablement
Correct Answer: B
Correct Answer
Answer B is correct because Guardrail means an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. This is the precise fit for the scenario. Automated service disablement serves the different purpose of workflow that disables accounts, services, or access when risk conditions are met.
Incorrect Answers
Answer A is incorrect because Reaction-time benefit refers to reduction in delay between detection and a predefined response action. The key mismatch is functional: Guardrail addresses an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service, the need stated by the question.
Answer C is incorrect because Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot. The concept is valid, but it does not match this stem. The required function is an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service, which maps to Guardrail.
Answer D is incorrect because Automated service disablement refers to workflow that disables accounts, services, or access when risk conditions are met. The scenario instead requires an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service, which is why Guardrail is the better answer; this option serves the different function defined above.
Question 14
To deploy repeatable resources with consistent security settings, which security approach should be selected?
- Single-point-of-failure risk
- Automated resource provisioning
- Automation complexity risk
- Automated ticket creation
Correct Answer: B
Correct Answer
Answer B is correct because Automated resource provisioning means creation of infrastructure or services through code, templates, or workflow. That makes it the best answer here; Automation complexity risk addresses operational risk created when automated workflows become difficult to understand, test, or troubleshoot, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Single-point-of-failure risk refers to risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. The scenario instead requires creation of infrastructure or services through code, templates, or workflow, which is why Automated resource provisioning is the better answer; this option serves the different function defined above.
Answer C is incorrect because Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot. This could be appropriate elsewhere, but the required function is creation of infrastructure or services through code, templates, or workflow; that makes Automated resource provisioning the precise choice.
Answer D is incorrect because Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events. The scenario instead requires creation of infrastructure or services through code, templates, or workflow, which is why Automated resource provisioning is the better answer; this option serves the different function defined above.
Question 15
Two requirements remain open in a security-automation engineering review: workflow that disables accounts, services, or access when risk conditions are met; risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. Which TWO options close those specific gaps? Choose TWO.
- Automated service disablement
- Single-point-of-failure risk
- API integration
- Technical debt risk
- Workforce-multiplier benefit
Correct Answers: A, B
Correct Answers
Answer A is correct because Automated service disablement means workflow that disables accounts, services, or access when risk conditions are met. One required function is exactly what this option provides. API integration may be useful elsewhere, but it is used for programmatic connection between security tools so one system can query or trigger actions in another.
Answer B is correct because Single-point-of-failure risk means risk that one orchestrator, integration, or dependency can disrupt many automated processes if it fails. This option satisfies a specific requirement in the stem; Technical debt risk serves future maintenance burden created by quick or poorly documented automation choices and therefore is not interchangeable with it.
Incorrect Answers
Answer C is incorrect because API integration means programmatic connection between security tools so one system can query or trigger actions in another. The question requires exactly 2 selections: Automated service disablement, Single-point-of-failure risk. This option falls outside that required set.
Answer D is incorrect because Technical debt risk means future maintenance burden created by quick or poorly documented automation choices. Every answer slot must map to a stated requirement. The correct set is Automated service disablement, Single-point-of-failure risk, so this option cannot replace one of those selections.
Answer E is incorrect because Workforce-multiplier benefit means use of automation to handle repeatable tasks so analysts can focus on higher-value decisions. The fixed-count answer set is Automated service disablement, Single-point-of-failure risk; this option does not fill one of those named functions.
Question 16
Reviewers working through a security-automation engineering review identify three separate needs: use of scripts, workflows, or identity systems to create accounts and access based on approved triggers; creation of infrastructure or services through code, templates, or workflow; automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. Which THREE choices map to those needs? Choose THREE.
- Guardrail
- Automated security-group management
- Automated user provisioning
- Automated escalation
- Automated resource provisioning
- Technical debt risk
Correct Answers: A, C, E
Correct Answers
Answer A is correct because Guardrail means an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. One required function is exactly what this option provides. Automated escalation may be useful elsewhere, but it is used for routing of alerts or tasks to higher-priority responders based on severity, time, or conditions.
Answer C is correct because Automated user provisioning means use of scripts, workflows, or identity systems to create accounts and access based on approved triggers. This option satisfies a specific requirement in the stem; Automated escalation serves routing of alerts or tasks to higher-priority responders based on severity, time, or conditions and therefore is not interchangeable with it.
Answer E is correct because Automated resource provisioning means creation of infrastructure or services through code, templates, or workflow. This selection maps directly to one of the named needs. Automated security-group management addresses use of code or workflow to create and update network or cloud access rules consistently, so it does not satisfy the same slot.
Incorrect Answers
Answer B is incorrect because Automated security-group management means use of code or workflow to create and update network or cloud access rules consistently. The question requires exactly 3 selections: Automated user provisioning, Automated resource provisioning, Guardrail. This option falls outside that required set.
Answer D is incorrect because Automated escalation means routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. Every answer slot must map to a stated requirement. The correct set is Automated user provisioning, Automated resource provisioning, Guardrail, so this option cannot replace one of those selections.
Answer F is incorrect because Technical debt risk means future maintenance burden created by quick or poorly documented automation choices. The question requires exactly 3 selections: Automated user provisioning, Automated resource provisioning, Guardrail. This option falls outside that required set.
Question 17
To increase operational capacity without linearly increasing staff, which security approach should be selected?
- Workforce-multiplier benefit
- Guardrail
- Automation complexity risk
- Technical debt risk
Correct Answer: A
Correct Answer
Answer A is correct because Workforce-multiplier benefit means use of automation to handle repeatable tasks so analysts can focus on higher-value decisions. This is the precise fit for the scenario. Automation complexity risk serves the different purpose of operational risk created when automated workflows become difficult to understand, test, or troubleshoot.
Incorrect Answers
Answer B is incorrect because Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. The key mismatch is functional: Workforce-multiplier benefit addresses use of automation to handle repeatable tasks so analysts can focus on higher-value decisions, the need stated by the question.
Answer C is incorrect because Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot. The question is not asking for this function. It is testing use of automation to handle repeatable tasks so analysts can focus on higher-value decisions, so Workforce-multiplier benefit is the stronger fit.
Answer D is incorrect because Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices. That concept can be valid in another scenario, but this question is testing use of automation to handle repeatable tasks so analysts can focus on higher-value decisions; Workforce-multiplier benefit therefore fits the requirement more directly.
Question 18
To ensure detected issues enter a trackable response process, which security approach should be selected?
- API integration
- Technical debt risk
- Automation complexity risk
- Automated ticket creation
Correct Answer: D
Correct Answer
Answer D is correct because Automated ticket creation means generation of service or incident records directly from monitoring or workflow events. The deciding point is functional fit: this option covers the stated need, while Automation complexity risk addresses operational risk created when automated workflows become difficult to understand, test, or troubleshoot.
Incorrect Answers
Answer A is incorrect because API integration refers to programmatic connection between security tools so one system can query or trigger actions in another. The scenario instead requires generation of service or incident records directly from monitoring or workflow events, which is why Automated ticket creation is the better answer; this option serves the different function defined above.
Answer B is incorrect because Technical debt risk refers to future maintenance burden created by quick or poorly documented automation choices. The scenario instead requires generation of service or incident records directly from monitoring or workflow events, which is why Automated ticket creation is the better answer; this option serves the different function defined above.
Answer C is incorrect because Automation complexity risk refers to operational risk created when automated workflows become difficult to understand, test, or troubleshoot. This could be appropriate elsewhere, but the required function is generation of service or incident records directly from monitoring or workflow events; that makes Automated ticket creation the precise choice.
Question 19
During a security-automation engineering review, the team has two independent requirements: (1) generation of service or incident records directly from monitoring or workflow events; and (2) routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. Which TWO choices best satisfy those requirements? Choose TWO.
- Reaction-time benefit
- Automated escalation
- Automated ticket creation
- Continuous integration security testing
- Automated resource provisioning
Correct Answers: B, C
Correct Answers
Answer B is correct because Automated escalation means routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. The fixed-count item needs this function in the answer set. Automated resource provisioning covers creation of infrastructure or services through code, templates, or workflow, a different requirement.
Answer C is correct because Automated ticket creation means generation of service or incident records directly from monitoring or workflow events. One required function is exactly what this option provides. Continuous integration security testing may be useful elsewhere, but it is used for automated security checks integrated into software build and delivery pipelines.
Incorrect Answers
Answer A is incorrect because Reaction-time benefit means reduction in delay between detection and a predefined response action. The fixed-count answer set is Automated ticket creation, Automated escalation; this option does not fill one of those named functions. For example, Automated escalation is required for routing of alerts or tasks to higher-priority responders based on severity, time, or conditions.
Answer D is incorrect because Continuous integration security testing means automated security checks integrated into software build and delivery pipelines. The question requires exactly 2 selections: Automated ticket creation, Automated escalation. This option falls outside that required set. For example, Automated ticket creation is required for generation of service or incident records directly from monitoring or workflow events.
Answer E is incorrect because Automated resource provisioning means creation of infrastructure or services through code, templates, or workflow. The fixed-count answer set is Automated ticket creation, Automated escalation; this option does not fill one of those named functions.
Question 20
To reduce delay when an event exceeds normal handling thresholds, which security approach should be selected?
- Baseline enforcement benefit
- Guardrail
- Automated ticket creation
- Automated escalation
Correct Answer: D
Correct Answer
Answer D is correct because Automated escalation means routing of alerts or tasks to higher-priority responders based on severity, time, or conditions. The requirement maps directly to this function, whereas Baseline enforcement benefit is aimed at automation that repeatedly applies approved configurations and detects or corrects drift.
Incorrect Answers
Answer A is incorrect because Baseline enforcement benefit refers to automation that repeatedly applies approved configurations and detects or corrects drift. The scenario instead requires routing of alerts or tasks to higher-priority responders based on severity, time, or conditions, which is why Automated escalation is the better answer; this option serves the different function defined above.
Answer B is incorrect because Guardrail refers to an automated policy constraint that prevents or flags insecure configurations while still allowing approved self-service. The key mismatch is functional: Automated escalation addresses routing of alerts or tasks to higher-priority responders based on severity, time, or conditions, the need stated by the question.
Answer C is incorrect because Automated ticket creation refers to generation of service or incident records directly from monitoring or workflow events. This could be appropriate elsewhere, but the required function is routing of alerts or tasks to higher-priority responders based on severity, time, or conditions; that makes Automated escalation the precise choice.
