4.1 Compare Concepts, Platforms, and Mechanisms of SOAR 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In which of the following scenarios is SOAR most beneficial?

   • AStoring and querying large volumes of log data for compliance reporting
   • BAutomating the initial triage of a high volume of low-severity alerts
   • CReplacing the need for human analysts in all security operations
   • DPerforming deep packet analysis to identify zero-day exploits
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a security incident, the SOC wants to automatically collect forensic data from affected endpoints, such as running processes and network connections, and then store it in a secure location for later analysis. Which SOAR mechanism should be used?

   • AA case management feature to document the incident.
   • BA SIEM correlation rule that triggers an alert when suspicious activity is detected.
   • CA threat intelligence feed that provides indicators of compromise.
   • DA playbook that uses integrations with endpoint detection and response (EDR) tools to collect and store the data.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the role of integrations in a SOAR platform?

   • ATo store large volumes of log data for long-term retention
   • BTo replace the need for external tools by providing all functionality natively
   • CTo allow the SOAR platform to connect and interact with external security tools and services
   • DTo provide a user interface for manual data entry
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team wants to use SOAR to support threat hunting. They want to automatically gather indicators of compromise (IOCs) from various sources, search their environment for these IOCs, and then create a report of any matches. Which SOAR capability is most relevant for this use case?

   • ACase management to track the threat hunting campaign.
   • BPlaybooks that automate the collection and search process across integrated tools.
   • CA dashboard that displays the current threat landscape.
   • DAn integration with the ticketing system to create tickets for matches.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a playbook in the context of SOAR?

   • AA log of all past security incidents and their resolutions
   • BA list of all users and their access permissions in the SOC
   • CA set of predefined, automated steps that guide incident response actions
   • DA document that lists all security tools and their configurations
   Reveal Solution Discussion Select an answer first