Automating Workflows

GASAE · 20 questions

• A city IR team standardizes PowerShell collectors for Windows evidence on Entra-joined staff laptops. What scripting goal does that serve?
• A county SOC uses Python notebooks to enrich phishing headers from 311-related mailbox incidents. What scripting practice does that reflect?
• A transit authority remediates CIS baseline drift on jump hosts with Ansible playbooks. What automation approach is that?
• A water utility writes idempotent scripts so re-running containment does not break payroll VMs. What script design property is that?
• A school district prefers signed scripts and constrained language mode for helpdesk-triggered fixes. What hardening practice is that?
• A city cloud team manages security groups and logging sinks for the permit application with Terraform. What IaC outcome does that support?
• A county wants policy-as-code checks in CI before Terraform apply to the elections support account. What control gate is that?
• A housing authority stores Sentinel analytic rules and playbook definitions beside Terraform modules. What DevSecOps practice does that reflect?
• A parks department rebuilds a disposable purple-team firing range from IaC overnight. What provisioning approach is that?
• An emergency-management agency rejects click-ops changes to IR buckets in favor of reviewed IaC pull requests. What change practice are they enforcing?
• A city purple team shares a git repository where red posts emulation plans and blue posts detections. What collaborative practice does that enable?
• A county fusion center uses a shared chat-ops channel with bots that open IR tickets from alerts. What collaborative automation is that?
• A transit SOC runs joint Jupyter enrichment sessions during major incident bridges. What collaborative environment are they using?
• A court clerk IT group keeps offensive and defensive runbooks in the same wiki with role-based edit rights. What documentation control is that?
• A public-health team schedules weekly purple syncs driven by automation metrics dashboards. What collaboration practice does that support?
• A city SOC factors common enrich-isolate-ticket steps into reusable workflow modules shared across playbooks. What reusable-workflow practice does that reflect?
• A county wants one workflow template that works for both malware and account-takeover tickets with branch-specific actions. What design goal is that?
• A library IT team parameterizes security workflows by branch site so shared logic uses different asset lists per location. What reusable pattern is that?
• A 311 security ops group version-tags workflow releases and rolls back a bad enrichment step after a failed deploy. What practice does that demonstrate?
• A city CISO asks for SLAs on automated workflow completion time for P1 ransomware tickets. What reusable-workflow expectation is being set?