GIAC GASAE: GIAC AI Security Automation Engineer

Last checked October 22, 2026 against the official GIAC exam page.

1. Question 1AI Infrastructure and Deployment Security

   A team deploys a self-hosted LLM inference service. Which control best prevents unauthorized use of the model endpoint?

   1. AAuthentication and authorization on the endpoint with rate limits and network restrictions
   2. BCommitting one shared API key to a public GitHub repo so contractors can reuse it
   3. CMaking the endpoint publicly accessible for ease of testing by outside QA teams
   4. DDisabling request logging on the inference gateway to reduce storage costs
   Show answer and explanationHide answer

   Correct answer: A

   Authentication, authorization, rate limits and network restrictions control who can use the endpoint and how much. Public access, public keys and disabled logs create abuse risk.

2. Question 2Defensive Automation and Detection Engineering

   A detection engineer wants detection rules to be tested and deployed like software. Which approach is recommended?

   1. AEditing rules directly in production with no history and no peer review step
   2. BDetection-as-code stored in version control with automated tests and staged deployment
   3. CKeeping rules undocumented in the memory of one senior analyst with no backup or handover notes
   4. DDeploying rules to each tenant in one batch without a regression test suite
   Show answer and explanationHide answer

   Correct answer: B

   Detection-as-code with versioning, tests and staged deployment makes changes reviewable and reversible. Direct edits, undocumented knowledge and untested global deployment increase risk.

3. Question 3Workflow and Orchestration Engineering

   A SOAR playbook must wait for an analyst's approval before isolating a host. Which design fits best?

   1. AA human approval task in the workflow with a timeout path and an audit record
   2. BUsing a random jitter delay of up to ten minutes instead of approval
   3. CIsolating the host first and asking for approval later via email
   4. DSkipping the approval step because automated containment is faster than waiting for an analyst
   Show answer and explanationHide answer

   Correct answer: A

   An approval task with timeouts and an audit record keeps a human in control of disruptive actions. Acting first, random delays and skipping approval remove the control.

4. Question 4Offensive Automation and Adversary Emulation

   A red team wants to automate an adversary emulation of a technique to test detection coverage. Which requirement must be met before running it?

   1. ARunning it on whatever internal network the team can reach
   2. BSkipping authorization because the test is automated and unattended
   3. CWritten authorization and a defined scope with safe, reversible actions
   4. DUsing real malware against production systems without limits
   Show answer and explanationHide answer

   Correct answer: C

   Authorization and a defined scope are required for legal and safe testing, and reversible actions limit harm. Unauthorized targets, skipped authorization and unlimited real malware are unacceptable.

5. Question 5Cloud Security Automation

   A team wants to block infrastructure templates that open a database port to the internet before they are deployed. Which approach implements this?

   1. AAsking developers to remember the rule and self-review before commit
   2. BPolicy-as-code checks in the pipeline that fail when a template exposes the port
   3. CA manual security review of templates once a quarter by the platform team
   4. DScanning templates with a posture tool after deployment to production accounts
   Show answer and explanationHide answer

   Correct answer: B

   Policy-as-code in the pipeline prevents exposure before deployment and gives consistent results. Quarterly reviews, post-deployment scans and memory-based rules are reactive or unenforced.