Free GASAE practice test: 30 questions with answers

Authentication, authorization, rate limits and network restrictions control who can use the endpoint and how much. Public access, public keys and disabled logs create abuse risk.

Hash or signature verification confirms integrity and provenance. Visual inspection, popularity and renaming do not verify that the artifact is unmodified.

Access control, encryption and transfer monitoring protect weights and data from theft. Public buckets, personal copies and disabled logs increase exfiltration risk.

A restricted tool set with least privilege and confirmation for sensitive actions limits what injected instructions can do. Admin rights, unrestricted APIs and trusting retrieved text enable abuse.

Source validation, provenance and removal capability limit poisoning. Unreviewed ingestion, blind trust and removing metadata make poisoned content harder to find and remove.

Detection-as-code with versioning, tests and staged deployment makes changes reviewable and reversible. Direct edits, undocumented knowledge and untested global deployment increase risk.

Reviewing samples and tuning logic with targeted exclusions reduces noise while preserving detection. Disabling sources, ignoring alerts and escalating everything are poor responses.

Testing against labeled data and code review validate AI-generated detections before deployment. Direct deployment, skipped review and public publication are unsafe.

Enrichment supplies context that accelerates triage while analysts still judge outcomes. It does not remove the need to understand alerts, lock them, or replace investigation.

Checking automated classifications against validated outcomes reveals missed threats and errors. Automatic closure counts and dashboards do not show accuracy, and title length is irrelevant.

An approval task with timeouts and an audit record keeps a human in control of disruptive actions. Acting first, random delays and skipping approval remove the control.

Checking for completion or using an idempotency key prevents duplicate side effects. Retries are not always safe for non-idempotent actions, and capitalization and logos are irrelevant.

Parallel branches with a join reduce latency and combine evidence before deciding. Unnecessary serialization, ignored sources and unread outputs reduce the value of the enrichment.

Compensating actions undo or correct earlier changes, which restores consistency. Ignoring partial states, deleting systems and hoping for repair do not restore correctness.

Version control and staging tests catch errors and make changes traceable. Direct production edits, personal folders and simultaneous global deployment increase risk.

Authorization and a defined scope are required for legal and safe testing, and reversible actions limit harm. Unauthorized targets, skipped authorization and unlimited real malware are unacceptable.

MITRE ATT&CK catalogs adversary tactics and techniques used for emulation and detection mapping. ISO 9001, PCI DSS and NIST SP 800-88 address other topics.

Emulation tests verify that detections fire for the behavior. Stealing real passwords, causing outages and disabling monitoring are not valid test goals.

Scope restrictions and human approval keep AI-assisted testing within authorized bounds. Free target selection, unrestricted IP use and removing scope documents violate the engagement.

The gap lies in how the alert is linked to the response, so the trigger and routing are the first fix. Dashboard colors, step counts and tool names do not explain the failure.

Policy-as-code in the pipeline prevents exposure before deployment and gives consistent results. Quarterly reviews, post-deployment scans and memory-based rules are reactive or unenforced.

Before and after state, trigger and actor support audit and rollback. A timestamp alone is incomplete, and skipping records or dashboard colors are not valid audit practices.

Revoking credentials and restricting permissions contain the threat while preserving evidence. Deleting logs, public exposure and week-long waits make the situation worse.

Scheduled evaluations against a baseline detect deviations across accounts consistently. Yearly manual checks, assumptions and name-based guesses do not detect drift reliably.

Least privilege limits the role to the specific read permissions required. Shared admin, implicit trust and permanent root access exceed the requirement.

LLM summaries can omit or invent details, so analysts should validate them against raw data before acting. Automatic closure, unlogged decisions and deleted raw logs all remove the controls that make automation trustworthy.

Idempotent steps converge to the same state on repeated runs, which is safe for retries. The other behaviors create duplicates, fail unnecessarily or destroy data.

Exponential backoff respects rate limits and recovers gracefully. Tight loops worsen throttling, false success hides failures, and permanent stops are excessive.

Minimizing and redacting data before external calls reduces exposure, and reviewing data handling terms addresses retention and training. Sending full logs, disabled controls and public samples expose sensitive information.

Hallucination is an unsupported but confident output. Normalization, quantization and sharding are different technical concepts.