Start Here
Five review stations, each a different way to practice Chapter 13. Work through them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or the exam.
What this chapter asked you to be able to do
- Distinguish among security automation (running actions without a human), orchestration (coordinating tools into a workflow), and integration (connecting tools so they can exchange data).
- Explain how a SOAR platform uses playbooks to automate incident response, and how it differs from a SIEM.
- Apply Infrastructure as Code security principles, including the large blast radius of a compromised pipeline and the controls that reduce it.
- Assess AI and machine learning uses such as behavioral analytics, anomaly detection, and automated risk scoring, along with their limits.
- Weigh the benefits and risks of automation and identify when a human-in-the-loop decision is required.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Matching Use Cases to Automation Concepts
Chapter 13 introduces several distinct capabilities. Read each use case and choose the single concept it describes, then check your answer.
Naming the Benefits and Risks of Automation
Automation brings measurable benefits and real risks. Read each outcome and choose the specific benefit or risk it illustrates, then check your answer.
Deciding When a Human Must Approve
Not every action should be fully automated. For each action, choose how the chapter's decision framework would handle it: automate fully, automate with a human approval or an automatic reversal, or defer to a human analyst.
Reference: decision matrix from Chapter 13
| Action | Criticality | Reversibility | Automation approach |
|---|---|---|---|
| Block IP address | Medium | Reversible (whitelist) | Automate with a one-hour auto-review |
| Disable user account | High | Reversible (re-enable) | Automate with senior analyst approval |
| Isolate test system | Low | Reversible | Automate fully |
| Isolate production system | High | Reversible but disruptive | Defer to a human analyst |
| Delete database | High | Not reversible | Never automate |
Detection, enrichment, logging, and notification are always safe to automate because they add information without changing system state.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.