4.1 Compare Concepts, Platforms, and Mechanisms of SOAR 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team currently uses a SIEM to collect and correlate logs. They want to add a layer that can automatically respond to certain incidents, such as disabling a compromised user account, without requiring an analyst to manually execute the steps. Which addition would best fulfill this requirement?

   • AA new SIEM correlation rule that triggers an alert when a user account is compromised.
   • BA ticketing system that creates a ticket for the incident.
   • CA SOAR platform that integrates with the SIEM and identity management system to automate the account disabling action.
   • DA manual runbook that documents the steps to disable a user account.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary difference between a SIEM and a SOAR platform?

   • ASIEM focuses on log collection and correlation, while SOAR focuses on automating response actions
   • BSIEM is a type of SOAR platform with additional features
   • CSIEM is used for incident response, while SOAR is used for vulnerability management
   • DSIEM is a cloud-based service, while SOAR is always on-premises
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations team is struggling with alert fatigue and wants to reduce the number of false positives that analysts need to investigate. They want to automatically filter out alerts that are known to be benign based on historical data. Which approach best leverages SOAR for this purpose?

   • AIncrease the SIEM's threshold for generating alerts.
   • BHave analysts manually review all alerts and mark them as false positives.
   • CCreate a playbook that checks incoming alerts against a list of known benign indicators and closes them automatically.
   • DDisable the SIEM alerts that are known to be noisy.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is choosing between two SOAR platforms. Platform A offers a large library of pre-built integrations with common security tools, while Platform B requires custom coding for each integration. The company has a small team and wants to deploy quickly. Which platform is more suitable and why?

   • APlatform A, because pre-built integrations reduce deployment time and effort.
   • BPlatform A, because it is always more secure than Platform B.
   • CPlatform B, because it is always cheaper than Platform A.
   • DPlatform B, because custom coding provides more flexibility.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does a SOAR platform typically integrate with a SIEM?

   • AThe SOAR platform sends all raw logs to the SIEM for storage
   • BThe SOAR platform is used to configure the SIEM's correlation rules
   • CThe SIEM replaces the SOAR platform, making it unnecessary
   • DThe SIEM sends alerts or incidents to the SOAR platform, which then executes automated response workflows
   Reveal Solution Discussion Select an answer first