Free Automation, Orchestration, and AI in SecOps practice questions
10 free SY0-801 questions on Automation, Orchestration, and AI in SecOps, each with a full explanation — no account needed. This section sits in the Security Operations part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
When the identity provider flags a risky sign-in, a workflow looks up the source address's reputation, checks whether the user's MFA methods changed recently and, only if both look bad, revokes the user's sessions and opens a ticket. Which term BEST describes this workflow?
Orchestration coordinates automated tasks across several systems in order, with decisions between the steps, and here the path depends on what the reputation and MFA checks return. Single-task automation runs one task without a person driving it, desired state management keeps configurations matching a declared baseline, and continuous integration builds and tests code changes.
A SOC's SIEM detects suspicious activity reliably, but analysts can't keep up with the response work, which means acting in the email gateway, the EDR console and the identity provider for each alert. What should the SOC add?
A SIEM collects and correlates events, while SOAR acts on what it finds, running playbooks across the email gateway, EDR and identity provider through their connectors. A second SIEM or more correlation rules would produce more alerts rather than handle them, and longer retention only keeps data longer.
A configuration management run reports ok for 140 Linux servers and changed for one server, where it set PermitRootLogin back to no. What should the team do with the changed result?
A changed result is both a fix and a finding: the tool reverted the drift, but someone edited the file, and that edit deserves a look rather than a silent revert. Closing it because the setting is back, removing the server from management or switching it to report-only would let whoever made the change keep doing it unnoticed.
SIEM alerts are sometimes lost at shift change, and 40 alerts about one host show up as 40 separate items that different analysts handle differently. Which automation BEST addresses this?
A ticket has an owner, a priority, a due time and a history, so automatically creating tickets, merging the 40 alerts into one, routing it to the team that owns the asset and escalating when the deadline passes stops alerts from getting lost. A dashboard or weekly report still depends on someone noticing, and adding staff to a volume problem is the classic wrong answer.
A nightly script disables enabled accounts whose replicated last-logon value in Active Directory is more than 7 days old. It keeps disabling people who signed in the previous day. What is the MOST likely cause?
Active Directory updates the replicated last-logon value only periodically, so it can trail the real last logon by up to about two weeks; a 90-day threshold absorbs that, but a 7-day one flags active users. Accounts that have never signed in are a real trap, but these users signed in yesterday, and an empty exemption group or a high per-run limit wouldn't make active users look idle.
A SOC is deciding which task to automate fully, with no person approving each run. Which task is the BEST candidate?
Enrichment happens with every alert, follows the same steps each time, saves analysts real time and is easy to check, so it passes every test for full automation. Notifying a regulator, paying a ransom and dismissing an employee all need judgment that can't be reduced to rules, so automation can gather evidence for them but a person decides.
A cleanup script disables every account whose name matches a pattern built from a $prefix variable followed by a wildcard. One night the setting that supplies $prefix fails to load, the variable is empty, and the pattern matches every account in the domain. Which practice would have prevented the outage?
An empty value widened the match to every account, so the fix is logic that validates its inputs and treats a missing or implausible value as a failure that stops the run. A kill switch only helps once someone notices, idempotence stops a retry from acting twice but not a wrong first run, and a personal admin account only makes the script's actions harder to tell apart from the person's.
A playbook closes alerts automatically when the threat intelligence lookup returns no matches. During a six-hour outage of the lookup service every request timed out, and the playbook closed 300 alerts as clean. Which logic flaw caused this?
A lookup that times out returns nothing, and the playbook read nothing found as clean; sound logic treats errors as failures and stops or escalates. A missing approval gate or dry-run mode describes absent guardrails around actions rather than the logic error itself, and idempotence is about a retry not acting twice.
A SOAR platform can disable accounts, isolate hosts and change firewall rules through its integrations. How should its integration credentials be managed?
An automation platform holds the combined power of several administrators, which makes it a high-value target, so its credentials belong in a vault and each integration gets only the permissions its playbooks need. One shared domain admin account is both overprivileged and a single point of failure, and credentials in code or shared with every analyst are easy to steal.
A new playbook that disables compromised accounts has passed testing in a lab with realistic data and a peer review, and its change approval includes a backout plan. What should happen NEXT?
A sound rollout runs the automation in report-only mode in production for a period, compares its decisions with what analysts actually did, and then enables actions for a limited scope first. Turning it on everywhere at once skips that check, the first live runs need close watching, and automation belongs on a hardened server with its own identity, not an administrator's workstation.
Study this section
Every lesson that covers Automation, Orchestration, and AI in SecOps on the SY0-801 exam.