4.1 Compare Concepts, Platforms, and Mechanisms of SOAR 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common feature of SOAR platforms?

   • AFirewall rule management and enforcement
   • BPacket capture and analysis for deep network forensics
   • CCase management to track incidents from detection to resolution
   • DVulnerability scanning and patch management
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst receives an alert from the SIEM about a potential malware infection. The SOAR playbook automatically enriches the alert with file reputation data and checks if the file hash is known. The playbook then presents the findings to the analyst with a recommendation to quarantine the endpoint. What is the primary benefit of this SOAR mechanism?

   • AIt reduces the analyst's cognitive load by providing context and a recommended action.
   • BIt eliminates the need for human analysts in the incident response process.
   • CIt automatically quarantines the endpoint without any human approval.
   • DIt replaces the SIEM as the primary alerting system.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is considering implementing a SOAR platform to improve their incident response. They have a mature SIEM and a well-defined incident response process. The SOC manager is concerned that SOAR might replace their existing processes and tools. What is the best way to address this concern?

   • ARecommend replacing the SIEM with the SOAR platform to simplify the environment.
   • BSuggest that SOAR will only be used for low-priority incidents, leaving the existing process unchanged for critical incidents.
   • CAdvise that SOAR will require a complete redesign of the incident response process.
   • DExplain that SOAR complements existing tools and processes by automating and orchestrating them, not replacing them.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best describes the role of SOAR in a security operations center (SOC)?

   • AIt helps analysts respond to incidents more efficiently by automating repetitive tasks and orchestrating workflows across tools
   • BIt replaces the need for human analysts by fully automating all security decisions
   • CIt provides a central repository for security alerts and logs
   • DIt primarily focuses on detecting threats by analyzing network traffic patterns
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's SOC uses a SOAR platform to handle phishing incidents. The current playbook sends an email to the analyst with all the details, but the analyst must manually copy the indicators into the EDR tool to block them. The team wants to reduce the time to containment. What should the SOAR administrator configure?

   • AA manual runbook that documents the steps for the analyst to follow.
   • BA case management feature that allows analysts to track the incident.
   • CA workflow that automatically extracts indicators and pushes them to the EDR via an integration.
   • DA new SIEM correlation rule that detects phishing emails and generates an alert.
   Reveal Solution Discussion Select an answer first