GIAC GASAE Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC AI Security Automation Engineer (GASAE) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GASAE certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GASAE Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC AI Security Automation Engineer (GASAE) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC AI Security Automation Engineer exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GASAE Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GASAE Sample Questions:
01. A deployIfNotExists policy that enables Defender for Storage settings is assigned at a management group. Newly created storage accounts in scope show as noncompliant, and the policy's deployments fail with an authorization error. The policy definition lists the roles its deployment requires.
What is the most likely cause?
a) No remediation task has been created, so the policy only evaluates and never deploys
b) The assignment's managed identity lacks the required roles at the scope it deploys into
c) The existence condition is evaluated before the account finishes provisioning
d) Storage accounts must be onboarded to Sentinel before Defender settings apply
02. A triage script truncates each alert payload to 6,000 characters before sending it to a hosted LLM API. Alerts written as English prose of that length are accepted, but alerts of the same character length that consist mostly of base64-encoded PowerShell and hex dumps are rejected with a context-length error.
What explains the difference?
a) The API meters UTF-8 bytes, and base64 text takes several bytes for each character
b) The model decodes the base64 before counting, which expands the script back to its full size
c) The limit counts words, and each unbroken blob is padded out to a fixed word size
d) Encoded strings split into far more tokens per character, and the limit counts tokens
03. An email-triage agent reads messages from a shared phishing-report mailbox and summarizes them for analysts. It has two tools: search_mailbox and send_email. In a red-team test, a reported message contains hidden text telling the agent to forward the last ten reports to an external address, and the agent does so.
Which two changes most reduce this risk?
(Choose two.)
(Choose two.)
a) Require analyst approval before any email the agent composes is sent
b) Add a system-prompt rule telling the agent to ignore instructions in emails
c) Remove send_email and give the triage agent read-only mailbox access
d) Use a model with a larger context window so whole threads fit in one call
e) Lower the temperature so the agent adheres more closely to its system prompt
04. A MITRE Caldera operation report for a lab exercise shows that the discovery abilities completed and the agent kept running later abilities afterwards. One ability that copies a test file to a remote share, which is in the adversary profile, was not run. Its command references a variable for the remote host that should be filled from discovery output, and the operation's fact list holds no value of that type.
What best explains why the ability was skipped?
a) The adversary profile omitted the ability, so the planner had nothing to schedule
b) A required fact was absent
c) The agent lost its connection and stopped beaconing before that ability
d) The ability's ATT&CK technique ID was missing from its definition
05. A pipeline deploys a Bicep template that defines a baseline network security group into a resource group that also holds a jump-box VM, its NIC and its disk, none of which are in the template. After the latest run the VM, NIC and disk were deleted. The template content was unchanged; only a deployment setting in the pipeline was edited.
What most likely caused the deletion?
a) The NSG baseline blocked management traffic, so the VM was deprovisioned
b) A what-if run applied its deletions
c) An Azure Policy deny effect removed resources violating the baseline
d) The deployment mode was switched to complete
06. An enrichment script makes two consecutive calls to a hosted LLM API. Call 1 sends a system prompt and the full alert JSON and asks for a one-paragraph summary, which comes back accurate. Call 2 sends the same system prompt and the single user message Now list every IOC from that alert as JSON. The reply contains plausible-looking IP addresses and hashes that do not appear in the alert.
What is the most likely cause?
a) Each API call is independent, so call 2 never contained the alert; prior turns must be resent with every request
b) The alert JSON from call 1 overflowed the context window; it was dropped before call 2 ran
c) The cached copy of call 1 expired on the provider side before the second request reached it
d) Call 2 used a higher default temperature than call 1, which made the IOC output random
07. An attacker used a stolen SSH private key to log in to a Linux bastion host as svc-deploy and added a public key of their own. The automated remediation playbook currently only resets the account password.
Which two additional actions are needed to evict the attacker?
(Choose two.)
(Choose two.)
a) Regenerate the bastion's SSH host keys so the stolen client key no longer matches the server
b) Move the SSH daemon to a non-standard port and update the firewall to allow only the new port
c) Remove unauthorized entries from the account's authorized_keys file and revoke the stolen key
d) Lock the password for svc-deploy so password authentication is refused
e) Terminate the account's existing SSH sessions after the credentials are cleaned up
08. A scheduled analytics rule in Microsoft Sentinel is set to run every 60 minutes and to query the previous 10 minutes of data. During a purple-team exercise, a burst of password-spray sign-ins that the query logic matches produced no alert. The rule had not fired earlier that day.
What explains the miss?
a) Scheduled rules create incidents only when an automation rule is attached to them
b) Each run looks back only 10 minutes, so 50 minutes of each hour go unqueried and the burst fell in that gap
c) Alert suppression on the rule discarded the alerts raised after the first trigger
d) The query must join a watchlist before a rule can match sign-in events
09. A Step Functions workflow contains a compromised EC2 instance by replacing its security groups with an isolation group, then queues EBS snapshots and a memory capture. During the last incident the instance was terminated a few minutes after isolation, before memory was captured. It belongs to an Auto Scaling group that uses load balancer health checks, and those checks began failing once the isolation group was applied.
Which change to the workflow prevents a repeat?
a) Detach the instance from its Auto Scaling group as the first step
b) Enable termination protection on the instance before replacing its security groups
c) Lengthen the group's health check grace period
d) Take the EBS snapshots first, so disk contents are kept before the swap
10. An EDR alert names source IP 10.20.4.17. The enrichment step queries the CMDB by IP and labels the asset as a low-criticality lab printer owned by Facilities. The analyst later finds the alert came from a finance manager's laptop on DHCP.
What is the most likely enrichment design flaw?
a) The enrichment ran before deduplication; it attached data from an earlier alert or case
b) The CMDB does not record criticality for laptops, so the step fell back to a default rating
c) IP addresses were used as stable keys, so resolve the IP to a host identity from DHCP or EDR data for the alert time first
d) Geolocation was not run on the source IP, so the step could not place the device in the finance office
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: d |
Question: 03 Answer: a, c |
Question: 04 Answer: b |
Question: 05 Answer: d |
|
Question: 06 Answer: a |
Question: 07 Answer: c, e |
Question: 08 Answer: b |
Question: 09 Answer: a |
Question: 10 Answer: c |
Note: For any error in GIAC AI Security Automation Engineer (GASAE) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
