GASAE practice questions
GIAC · GASAE · 200 questions
Original practice questions for the GIAC AI Security Automation Engineer (GASAE) exam, covering adversary emulation fundamentals, AI fundamentals (LLMs, RAG, agentic AI), automated offensive and general security workflows, AWS and Azure cloud security and incident-response automation, defensive security automation, security automation fundamentals, SOAR, and automation plus AI for detection engineering and incident response — framed in civic and municipal scenarios such as city / county SOC and fusion centers, municipal cloud tenants, transit / utilities / emergency-management ops, public-health IR, and permitting / 311 / courts infrastructure automation. Live GASAE is CyberLive; this bank is original 4-option MCQ similar-concept practice, not a lab dump.
This course contains the use of artificial intelligence.
About the GASAE exam
- Time allowed
- 3 hours
- Questions
- 82
- Passing score
- 70%
- Format
- 1 proctored exam, 82 questions, 3 hours
Exam details published by the vendor, checked 23 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
Adversary Emulation Fundamentals · 20 questions
- A city purple team wants to map planned validation tests to MITRE ATT&CK before buying a BAS tool. Which approach best frames those municipal control checks?
- A county fusion center debates Atomic-style technique libraries versus a full multi-stage campaign plan for purple-team validation. What distinction should the lead emphasize?
- A transit authority asks whether a Caldera-class open emulation framework fits better than a commercial BAS for its first purple-team year. What selection criterion best matches civic maturity?
- A water utility SOC wants emulation coverage only for techniques relevant to Windows jump hosts and VPN gateways. How should the team scope the emulation framework?
- A school-district purple team must document which ATT&CK tactics each quarterly emulation covers for auditors. What practice best turns the framework into an evidence map?
- A housing authority evaluates continuous BAS agents versus scheduled campaign runs on shared workstations. Which operating model best fits low-disruption municipal environments?
- A public-health department wants automated phishing-resilience checks without running live social-engineering against residents. Which BAS approach stays inside authorized municipal scope?
- A court IT team needs breach simulation that proves EDR detections without encrypting evidence shares. Which BAS scenario choice is appropriate?
- A 311 operations center asks how BAS reporting proves detection gaps to city council IT oversight. What interpretation is most useful?
- A library consortium prefers cloud BAS targeting Entra-joined staff laptops over on-prem only. What platform alignment best matches that hybrid municipal reality?
- A parks department security lead wants scripts that replay known ransomware precursor behaviors in a lab VLAN. What automation practice best fits?
- A county assessor office needs repeatable emulation of credential-dumping detections after each patch Tuesday. How should automation be designed?
- An emergency-management agency wants to parameterize emulation playbooks so the same chain runs in staging then limited prod. What design choice supports safe reuse?
- A municipal SOC asks whether technique automation should be detection-as-code triggered or manually queued. Which guidance fits adversary-behavior automation in SOC workflows?
- A city red/blue working group stores emulation plans as versioned YAML beside detection rules. What benefit does that practice provide?
- A transit SOC wants to chain initial access → persistence → discovery in one authorized exercise window. What readiness goal does that chaining serve?
- A county IR lead insists emulation chains stop before impact and always page change control. Which principle is being applied?
- A public works IT team maps each hop in an emulation chain to expected SIEM alerts and playbook steps. Why is that mapping valuable?
- A housing IT purple team reuses the same chain monthly but rotates hosts to avoid detector overfitting. What validity concern does host rotation address?
- A city CISO asks whether BAS chain coverage should prioritize crown-jewel permit and payroll systems first. What prioritization approach is sound?
Artificial Intelligence Fundamentals · 20 questions
- A city SOC analyst wonders why an LLM summarizing tickets sometimes truncates long permit-system logs. Which AI text-processing limit best explains that behavior?
- A county IR team asks how tokenization affects searching rare hostnames in alert text. What connection should they understand?
- A transit fusion center compares keyword regex enrichment versus semantic similarity over ticket text. Which contrast is most accurate?
- A public-health SOC sees an LLM invent CVE IDs when given sparse malware notes. What risk does that illustrate?
- A court security team wants embeddings of procedure manuals for later retrieval, not free chat. Which approach matches that goal?
- A 311 security ops pilot wants an LLM to draft first-pass phishing ticket summaries so analysts can prioritize faster. Which use case best fits that municipal SOC need?
- A school-district SOC must triage noisy EDR notes and prefers terminology that matches detection playbooks. Which model choice best matches that defensive triage task?
- A water utility security team refuses to paste SCADA runbooks into a public LLM endpoint. What judgment does that decision correctly apply?
- A housing-authority SOC wants LLM-generated IR playbook drafts that stay close to approved procedures rather than inventing creative new steps. Which generative setting best supports that goal?
- A parks IT security team wants an LLM only to rewrite verbose SIEM alerts into fixed structured fields for a ticketing system. What role limitation best matches that design?
- A city detection engineer wants LLM detection suggestions grounded in the local Sigma and detection-rule git repository. Which approach best achieves that?
- A county SOC builds a vector index of past IR tickets so analysts can enrich new incidents with similar historical context. Which technique does that describe?
- A transit fusion-center team is indexing IR runbooks for RAG and debates how to split the documents. Which chunking approach best supports retrieving coherent municipal procedures?
- An emergency-management SOC requires every AI answer about response policy to show citations from retrieved municipal policies. What does that requirement enforce?
- A library IT security group configures RAG so the assistant may retrieve only from approved SharePoint security libraries. What control does that implement?
- A city security architect must label malware families from EDR features and separately draft narrative IR notes for stakeholders. Which model-type contrast is most accurate?
- A county purple team defines agentic AI for their lab as systems that plan steps, call tools, and iterate toward a goal. How does that differ from a single-shot LLM call?
- A public-works SOC wants an AI agent that can query SIEM APIs and then propose containment steps, but only after a human approves any action. Which design matches that requirement?
- A housing SOC refuses fully autonomous agents that can disable user accounts without a two-person rule. What principle does that apply?
- A city CISO asks how a multi-agent red/blue simulation differs from a single chat assistant. What contrast should the automation lead emphasize?
Automating Offensive Workflows · 20 questions
- A city red team wants automated Atomic-style adversary emulation runs scheduled after change windows, not during payroll processing. What deployment practice does that reflect?
- A county purple team stores credentials used by offensive automation in a secrets vault separate from everyday production admin accounts. Why is that practice important?
- A transit authority requires every automated exploit-simulation job that targets staging to include an operator kill-switch. What control does that requirement build in?
- A school-district purple team packages adversary emulation as CI jobs that may run only on labeled lab runners. What constraint does that enforce?
- A public-health IR lead requires every automated offensive job to emit an audit trail into the SIEM. What accountability goal does that serve?
- A city SOC pilots an agentic AI that proposes the next ATT&CK technique steps for authorized emulation but waits for an operator to confirm before executing. What pattern does that illustrate?
- A county team rejects an agentic offensive agent that would be allowed to install payloads on unmanaged library kiosk PCs. What scoping decision is correct?
- A water-utility purple team uses multi-agent roles (recon, persistence, detect-check) for offensive simulation, but only inside an isolated cyber range. What practice does that reflect?
- A housing authority wants agentic offensive automation to check whether EDR blocked a known technique, not to invent new malware. What focus is correct?
- A parks department limits an agentic offensive workflow so it may call only approved emulation APIs and forbids interactive shell on domain controllers. What safeguard is that?
- A city cloud team evaluates Automated Emulation and PurpleCloud-style patterns for municipal AWS accounts. What platform choice is that team making?
- A county Azure landing zone needs continuous attack simulation against publicly exposed application gateways only. What targeting practice should guide that cloud emulation?
- A transit DevSecOps group wants cloud emulation that exercises IAM privilege paths without deleting storage buckets. What scenario quality are they prioritizing?
- An emergency-management agency maps cloud emulation findings back to Defender and GuardDuty alerts. What loop is that team closing?
- A library consortium prefers managed BAS-in-cloud over self-hosted attack VMs because staffing is thin. What tradeoff are they weighing?
- A city purple team orchestrates access, discovery, and lateral-movement simulations as one Tines story. What automation pattern does that illustrate?
- A county team chains cloud misconfiguration probes and then endpoint technique tests into one exercise plan. What exercise design are they using?
- A court IT group uses orchestration to pause between chained offensive stages so the blue team has observation time. What purple-team control is that?
- A 311 SOC wants orchestration that tags each simulated action with an exercise-ID for alert correlation. What correlation practice does that enable?
- A city CISO requires tabletop approval before any orchestrated offensive chain touches production jump hosts. What governance gate is that?
Automating Workflows · 20 questions
- A city IR team standardizes PowerShell collectors for Windows evidence on Entra-joined staff laptops. What scripting goal does that serve?
- A county SOC uses Python notebooks to enrich phishing headers from 311-related mailbox incidents. What scripting practice does that reflect?
- A transit authority remediates CIS baseline drift on jump hosts with Ansible playbooks. What automation approach is that?
- A water utility writes idempotent scripts so re-running containment does not break payroll VMs. What script design property is that?
- A school district prefers signed scripts and constrained language mode for helpdesk-triggered fixes. What hardening practice is that?
- A city cloud team manages security groups and logging sinks for the permit application with Terraform. What IaC outcome does that support?
- A county wants policy-as-code checks in CI before Terraform apply to the elections support account. What control gate is that?
- A housing authority stores Sentinel analytic rules and playbook definitions beside Terraform modules. What DevSecOps practice does that reflect?
- A parks department rebuilds a disposable purple-team firing range from IaC overnight. What provisioning approach is that?
- An emergency-management agency rejects click-ops changes to IR buckets in favor of reviewed IaC pull requests. What change practice are they enforcing?
- A city purple team shares a git repository where red posts emulation plans and blue posts detections. What collaborative practice does that enable?
- A county fusion center uses a shared chat-ops channel with bots that open IR tickets from alerts. What collaborative automation is that?
- A transit SOC runs joint Jupyter enrichment sessions during major incident bridges. What collaborative environment are they using?
- A court clerk IT group keeps offensive and defensive runbooks in the same wiki with role-based edit rights. What documentation control is that?
- A public-health team schedules weekly purple syncs driven by automation metrics dashboards. What collaboration practice does that support?
- A city SOC factors common enrich-isolate-ticket steps into reusable workflow modules shared across playbooks. What reusable-workflow practice does that reflect?
- A county wants one workflow template that works for both malware and account-takeover tickets with branch-specific actions. What design goal is that?
- A library IT team parameterizes security workflows by branch site so shared logic uses different asset lists per location. What reusable pattern is that?
- A 311 security ops group version-tags workflow releases and rolls back a bad enrichment step after a failed deploy. What practice does that demonstrate?
- A city CISO asks for SLAs on automated workflow completion time for P1 ransomware tickets. What reusable-workflow expectation is being set?
AWS Cloud Security and Incident Response Automation · 20 questions
- A city AWS account for online permitting must prove CloudTrail and AWS Config are enabled in every organizational unit. What automation focus is that?
- A county wants GuardDuty findings to open IR tickets automatically without analysts watching the AWS console all day. What monitoring automation pattern is that?
- A transit authority centralizes VPC Flow Logs into a security account for correlation across fare and operations VPCs. What telemetry design is that?
- A school district uses AWS Config rules to flag public S3 buckets that may hold student records. What compliance automation is that?
- A public-health department maps AWS Security Hub controls to its HIPAA-adjacent checklist for continuous evidence. What automation alignment is that?
- A city IR playbook auto-isolates an EC2 instance tagged as compromised only after dual human approval. What AWS response design is that?
- A county uses Lambda-backed response to snapshot EBS volumes before wiping a malware-hit jump box. What IR automation priority is that?
- A housing authority revokes suspicious IAM access keys through automation when GuardDuty flags them. What AWS IR action is that?
- A parks department quarantines a compromised ECS task without taking down the entire cluster serving park reservations. What containment approach is that?
- An emergency-management AWS account uses Step Functions to collect logs then notify the fusion center during an incident. What IR automation pattern is that?
- A city runs continuous Security Hub improvement sprints driven by automated finding trends rather than one-time audits. What AWS security practice is that?
- A county remediates common CIS AWS Foundations failures with event-driven automation when Config detects drift. What improvement pattern is that?
- A transit DevSecOps team measures mean time to remediate public-exposure findings month over month on AWS. What continuous-improvement signal is that?
- A library consortium promotes auto-remediation from staging AWS accounts to production only after a burn-in period. What safe-promotion practice is that?
- A water utility tags every automated AWS security fix with a linked change ticket for auditors. What continuous-improvement control is that?
- A city SOC uses a Bedrock-class generative assist to draft IR summaries from CloudTrail excerpts for analysts to review. What AI-assisted AWS workflow is that?
- A county detection team asks an AI agent to propose Athena queries over VPC Flow Logs, then requires analyst review before execution. What AI-assisted investigation pattern is that?
- A housing authority refuses sending raw citizen PII from S3 access logs to an external generative model. What AI workflow control is that?
- A 311 cloud team builds an agent that may recommend Security Hub suppressions only when it also supplies justification text for analysts. What controlled AI triage practice is that?
- A city architect ties Bedrock agents to read-only IAM roles for investigation and never grants them delete APIs. What AI-assisted AWS design is that?
Azure Cloud Security and Incident Response Automation · 20 questions
- A city deploys municipal landing-zone NSGs and diagnostic settings only through Bicep or Terraform pull requests. What Azure security practice is that?
- A county wants Azure Policy to deny public IP addresses on virtual machines in the courts resource group. What guardrail is that?
- A transit authority templates private endpoints for Key Vault used by fare-collection systems. What IaC security pattern is that?
- A school district applies landing-zone modules that enable Microsoft Defender plans by default. What Azure IaC practice is that?
- A housing authority drifts from IaC when helpdesk manually opens RDP; automation must catch it. What control focus is that?
- A city enables Microsoft Defender for Cloud recommendations to create work items for the SOC. What automation is that?
- A county auto-triggers investigation packages when Defender for Endpoint flags ransomware behaviors on clerk PCs. What IR link is that?
- A public-health tenant uses Defender alerts to start just-in-time access reviews for admins. What privileged-access response is that?
- A parks department tunes Defender alert suppression for known vulnerability-scanner noise. What operational practice is that?
- A library consortium maps Defender secure score trends to quarterly council security reports. What continuous-improvement use is that?
- A city SOC builds Microsoft Sentinel analytics for impossible travel on Entra IDs used by remote inspectors. What monitoring practice is that?
- A county uses Sentinel automation rules to enrich incidents with the CMDB owner for each VM. What IR enrichment pattern is that?
- A transit fusion center runs Sentinel playbooks that isolate hybrid-joined devices only after dual control. What containment pattern is that?
- An emergency-management agency exports Sentinel incidents to the regional fusion ticket system. What integration is that?
- A court IT team versions Sentinel analytics as code and tests them in a non-prod workspace first. What detection practice is that?
- A city evaluates Azure OpenAI-assisted incident summarization inside Sentinel with private networking. What AI-assisted IR design is that?
- A county wants AI to suggest KQL but requires analyst sign-off before saving analytics. What governance pattern is that?
- A water utility blocks sending OT historian data to Azure AI services used by the IT SOC. What data-boundary practice is that?
- A 311 team uses Copilot-style assist only on already-redacted Sentinel incident narratives. What minimization practice is that?
- A city CISO asks whether AI-driven Azure recommendations replace or only augment Defender secure score work. What positioning is correct?
Defensive Security Automation · 20 questions
- A city must deploy EDR agents to all hybrid-joined endpoints including seasonal parks staff laptops. What defensive automation focus is that?
- A county uses Intune or GPO automation to heal missing logging agents on clerk desktops. What agent-ops pattern is that?
- A transit authority stages Velociraptor-class collectors only on labeled IR jump hosts first. What rollout pattern is that?
- A school district monitors agent health dashboards and tickets machines offline more than 24 hours. What operational control is that?
- A housing authority refuses agents that need local admin forever after install. What deployment requirement is that?
- A city IR playbook auto-collects prefetch, authentication logs, and browser history on suspected phishing hosts. What defensive automation practice is that?
- A county uses remote collection that hashes files before transfer to the evidence share. What artifact-handling goal does that automation serve?
- A public-health SOC limits automated collection so it never pulls full EHR database dumps during host triage. What scoping principle is that?
- A parks IT team schedules memory captures only when ransomware-class alerts fire. What collection strategy is that?
- A library consortium centralizes collected artifacts into a WORM evidence bucket with retention tags. What evidence-handling automation is that?
- A city enrichment pipeline adds GeoIP, WHOIS, and CMDB owner to every external IP in alerts. What enrichment practice is that?
- A county skips detonation-sandbox enrichment for URLs that resolve inside the permit application domain. What enrichment rule is that?
- A transit SOC caches threat-intel lookups so enrichment stays within API rate limits during major events. What enrichment design is that?
- An emergency-management fusion center enriches security alerts with weather and event context during disasters. What enrichment approach is that?
- A court security team strips SSNs from tickets before enrichment calls leave the network. What enrichment safeguard is that?
- A city feeds automated enrichments into both the SOC SIEM and the regional fusion center portal. What integration pattern is that?
- A county wants fusion analysts to reuse the same artifact packages the SOC already collected. What integration goal is that?
- A 311 security ops desk receives only high-severity enriched tickets while low noise stays in the SIEM. What routing pattern is that?
- A water utility maps OT-adjacent IT alerts into the fusion taxonomy without exposing plant networks. What integration practice is that?
- A city CISO measures defensive automation by reduced dwell time from alert to enriched ticket in the SOC. What effectiveness approach is that?
Security Automation Fundamentals · 20 questions
- A city CIO confuses SOAR orchestration with simple scheduled scripts for password resets. What terminology distinction should security leaders teach?
- A county security lead asks when to use detection-as-code instead of ad-hoc SIEM clicks. What strategy vocabulary applies?
- A transit authority defines policy-as-code as preventive guardrails, not as IR playbooks. What terminology clarity is that?
- A school district glossary standardizes playbook, runbook, and workflow for auditors. What fundamentals practice is that?
- A housing authority separates enrichment automation from containment automation in architecture diagrams. What layering practice is that?
- A city ranks ticket types by volume times toil to choose the first SOAR candidates. What selection method is that?
- A county rejects automating rare executive-targeted IR until human playbooks stabilize. What candidate-selection judgment is that?
- A public-health SOC prioritizes automating indicator enrichment before full host isolation. What investment ordering is that?
- A parks department refuses to automate any action that can brick seasonal point-of-sale terminals. What selection filter is that?
- A library IT group pilots security automation on a single branch before enterprise rollout. What selection practice is that?
- A city writes an automation design doc covering triggers, inputs, outputs, and failure modes before go-live. What planning practice is that?
- A county maps owners, on-call, and rollback for every new automated containment action. What deploy-planning practice is that?
- A transit team stages security automation in detect-only mode for two weeks before enforce. What deployment approach is that?
- An emergency-management agency load-tests IR automation before hurricane season. What planning practice is that?
- A court IT group requires peer review of automation pull requests the same as application code. What change-control practice is that?
- A city applies CI/CD to detection content with lint, unit tests, and staged promote. What DevOps practice is that?
- A county uses infrastructure pipelines so security logging sinks deploy with every new app. What DevOps alignment is that?
- A water utility treats automation failures as incidents with blameless postmortems. What reliability culture practice is that?
- A 311 platform team versions automation configs and forbids undocumented production hotfixes. What DevOps discipline is that?
- A city CISO ties the automation backlog to OKRs for mean time to respond. What roadmap practice is that?
Security Orchestration Automation and Response · 20 questions
- A city SOC designs a phishing SOAR playbook that detonates the URL, checks intel, notifies the user, and resets credentials if needed. What design practice is that?
- A county requires human approval before any SOAR step that disables Entra accounts for judges. What playbook design control is that?
- A transit authority splits SOAR playbooks into enrichment-only and containment modules for reuse. What design approach is that?
- A school district encodes error handling when the sandbox API is down mid-playbook. What resilience practice is that?
- A housing SOC versions SOAR playbooks and can roll back after a bad auto-reset wave. What release practice is that?
- A city integrates EDR, email gateway, CMDB, and ITSM into one SOAR case. What integration pattern is that?
- A county uses independent webhooks so losing the ticketing connector does not stop enrichment. What integration design is that?
- A public-health team maps least-privilege API keys per SOAR integration. What connector security practice is that?
- A parks department prefers read-only SOAR integrations first, then write actions after metrics prove value. What privilege approach is that?
- A library consortium documents every SOAR action that can modify production mailboxes. What integration governance practice is that?
- A city evaluates low-code SOAR versus custom Python workers for high-volume phishing. What platform decision is that?
- A county fusion center needs SOAR stories that can be exported for mutual-aid partners. What platform pattern is that?
- A transit SOC standardizes case schemas so different SOAR tools still feed one metrics lake. What platform pattern is that?
- An emergency-management agency uses SOAR to fan-out notifications to on-call and public-info officers. What orchestration pattern is that?
- A court IT team rejects SOAR vendors that cannot run in their sovereign cloud region. What platform selection constraint is that?
- A city SOC wants a SOAR success metric that reflects analyst minutes saved on each phishing case. Which measurement approach best supports that municipal efficiency goal?
- A county enables auto-isolate playbooks and wants to know whether containment is safe as well as fast. Which metric best captures that SOAR effectiveness concern?
- A 311 security desk has thin overnight staffing and still must meet alert SLAs. How should SOAR be used to address that coverage gap?
- A water utility holds weekly SOAR case reviews to remove noisy playbook branches that waste analyst time. What continuous-improvement practice is that?
- A city CISO must brief council on SOAR adoption across the highest-volume municipal alert types. Which reporting approach best supports that executive update?
Using Automation and AI for Detection Engineering and Incident Response · 20 questions
- A city maps each SOAR action to PICERL phases so gaps in automated IR support are visible. What practice does that mapping establish?
- A county wants generative AI to draft situation reports only after containment is confirmed. Where should that assist sit in the IR lifecycle?
- A transit SOC wants evidence preservation to finish before eradication playbooks run. How should automated IR actions be ordered?
- A public-health team wants every P1 incident to capture lessons learned through automation rather than hoping someone remembers. Which approach best fits the IR lifecycle?
- A school district organizes SOAR folders by NIST-style IR phases to teach new analysts the response model. What training practice is that?
- A city needs automated forensic triage timelines for ransomware hosts using Timesketch/Velociraptor-class tooling. Which approach best fits municipal IR?
- A county wants memory images hashed and cataloged by workflow before analysts review them. What forensic automation practice is that?
- A housing authority limits automated deep forensic pulls to machines that are already isolated. What gating practice does that enforce?
- A parks IT team needs scripted forensic analysis to timeline auth anomalies across multiple branch sites. Which approach best fits that multi-site civic need?
- A library consortium wants forensic automation outputs stored with case IDs that match SOAR. Why does that linkage matter?
- A city detection engineer uses an LLM to draft Sigma from ATT&CK notes, then tests the rule in CI. Which practice best describes that workflow?
- A county wants to catch detection regressions by replaying historical municipal alerts against new rules. What automation practice is that?
- A transit team refuses to promote AI-generated detections that lack unit tests. What quality gate is that enforcing?
- An emergency-management SOC promotes detections only after purple-team emulation confirms hits. What loop does that close?
- A court IT group versions detections and requires peer review the same way application PRs do. What discipline is that applying?
- A city SOC wants an agent to propose next investigation queries from the current Sentinel incident graph. Which capability is that using?
- A county forbids generative models from executing containment APIs unless a human provides a token. What autonomy limit is that?
- A 311 team grounds AI suggestions in past tickets so similar resolved civic incidents surface during triage. Which technique is that?
- A water utility evaluates AI SOC assist by whether mean time to understand drops without raising wrong-isolate counts. What evaluation approach is that?
- A city CISO pilots agentic enrichment first and defers agentic response until audit signs off. What adoption strategy is that?
These questions are original practice material and are NOT actual exam questions, CyberLive lab tasks, or brain-dump content. This site is not affiliated with, endorsed by, or sponsored by GIAC or SANS Institute. All GIAC, SANS, GASAE, and related marks are trademarks of their respective owners.