4.1 Compare Concepts, Platforms, and Mechanisms of SOAR 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC team is using a SOAR platform to handle phishing incidents. The current playbook automatically extracts URLs and checks them against a threat intelligence feed. If the URL is malicious, the playbook automatically blocks it in the proxy and sends a notification to the user. However, the team has received complaints that some legitimate URLs are being blocked. What is the most likely cause and what is the best solution?

   • AThe proxy integration is malfunctioning, so the playbook should be replaced with manual blocking.
   • BThe notifications are not being sent correctly, so users are not aware of the blocks.
   • CThe threat intelligence feed is outdated, so the playbook should be updated to use a more reliable feed.
   • DThe playbook is not checking the reputation score threshold, so it should be adjusted to only block URLs with a high confidence score.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC team is implementing a SOAR platform and wants to automate the response to a specific type of malware alert. The playbook should automatically quarantine the affected endpoint, but only if the endpoint is not a critical server. If it is a critical server, the playbook should only create a high-priority ticket for manual review. The team also wants to ensure that the quarantine action is reversible. Which playbook design best meets these requirements?

   • AA playbook that only creates a ticket for all alerts, leaving the quarantine decision to the analyst.
   • BA playbook that always quarantines the endpoint, regardless of criticality, and then creates a ticket.
   • CA playbook that quarantines the endpoint and then immediately deletes the quarantine rule to ensure reversibility.
   • DA playbook that checks the endpoint's criticality, and if not critical, executes the quarantine action via the EDR integration; otherwise, creates a ticket.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small security team is overwhelmed by the volume of alerts and often misses critical incidents because they spend too much time on repetitive tasks like gathering context and opening tickets. They want a solution that helps them prioritize alerts and automates the initial investigation steps. Which solution best addresses this need?

   • ADeploy a SOAR platform to automate alert triage and orchestrate the initial investigation steps.
   • BImplement a ticketing system to track all alerts.
   • CIncrease the SIEM's log retention period to ensure more data is available for analysis.
   • DHire more analysts to manually handle the alerts.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of a Security Orchestration, Automation, and Response (SOAR) platform?

   • ATo collect and aggregate log data from multiple sources for centralized storage and querying
   • BTo replace all existing security tools with a single integrated solution
   • CTo automate and orchestrate security operations processes, such as incident response, by integrating with various security tools
   • DTo provide a graphical interface for manually managing security alerts without automation
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations team receives hundreds of low-severity alerts daily from their SIEM. They want to automatically enrich each alert with threat intelligence, check if the involved IPs are on a blocklist, and if so, automatically create a ticket in their ticketing system for a human analyst to review. The team wants to minimize manual effort while keeping a human in the loop for any action that could disrupt services. Which approach best meets these requirements?

   • AConfigure the SIEM to send all alerts directly to the ticketing system via email.
   • BImplement a SOAR playbook that triggers on SIEM alerts, enriches with threat intel, checks blocklists, and creates a ticket only if the IP is blocklisted.
   • CUse the SIEM's built-in correlation rules to automatically block the IPs and then send a notification to the security team.
   • DDeploy a separate orchestration platform that only handles ticket creation, while the SIEM continues to handle all alert analysis.
   Reveal Solution Discussion Select an answer first