4.1 Compare Concepts, Platforms, and Mechanisms of SOAR 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC team wants to automate the initial triage of phishing emails reported by users. They want the SOAR platform to automatically extract URLs and attachments, check them against reputation services, and then either close the incident as benign or escalate it to an analyst. What is the most appropriate way to implement this?

   • ACreate a playbook that defines the steps for extraction, reputation check, and conditional escalation.
   • BUse a case management feature to manually track each reported email.
   • CConfigure a SIEM correlation rule to detect phishing emails.
   • DSet up an email filter to automatically delete all reported phishing emails.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a SOAR platform?

   • ANessus
   • BIBM QRadar SOAR (formerly Resilient)
   • CSplunk Enterprise Security
   • DWireshark
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How can SOAR assist in threat hunting activities?

   • ABy providing a platform for manual analysis of malware samples
   • BBy replacing the need for threat hunters with fully automated detection
   • CBy automatically executing predefined queries across multiple data sources to identify potential threats
   • DBy blocking all suspicious network traffic automatically
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is evaluating two SOAR platforms. Platform X has a visual playbook builder and a large marketplace of integrations, but its case management is basic. Platform Y has advanced case management and a flexible API, but requires more custom development for integrations. The company's SOC needs to handle complex incidents that require extensive collaboration and documentation, and they have a dedicated integration team. Which platform is more suitable and why?

   • APlatform X, because it has a larger marketplace of integrations, which is always the most important factor.
   • BPlatform Y, because its advanced case management meets the SOC's collaboration and documentation needs, and the integration team can handle custom development.
   • CPlatform X, because the visual playbook builder is more important than case management.
   • DPlatform Y, because it is always more secure than Platform X.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is evaluating SOAR platforms and needs one that supports custom playbooks, integrates with their existing SIEM and ticketing system, and provides a case management interface for analysts. Which feature set is most important to verify in the platform?

   • AA drag-and-drop playbook builder, pre-built integrations for the SIEM and ticketing system, and a case management module.
   • BA threat intelligence feed and automated blocking capabilities.
   • CA built-in SIEM with advanced correlation rules and its own ticketing system.
   • DA reporting dashboard and a mobile app for analysts.
   Reveal Solution Discussion Select an answer first