4.5 Determine Opportunities for Automation, Orchestration, and Machine Learning Within a SOAR Platform 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is designing a SOAR workflow for ransomware response. The workflow must automatically isolate affected endpoints, but the decision to restore from backup should only occur after a forensic investigation confirms the backup is clean. The team wants to minimize response time while ensuring safety. How should the workflow be designed?

   • AAutomatically isolate endpoints, then pause the workflow and require manual approval before initiating the forensic investigation and backup restoration.
   • BRequire manual approval for isolation, then automatically run the forensic investigation and restore from backup.
   • CAutomate the forensic investigation and backup restoration, but require manual approval for isolation.
   • DAutomatically isolate endpoints and restore from backup without any manual steps to speed up recovery.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team wants to automate the response to malware alerts. They want the SOAR platform to automatically isolate the affected endpoint and then, after isolation, require an analyst to approve the next step of remediation. How should the workflow be designed?

   • AAutomate the entire workflow but send a notification to the analyst after completion.
   • BAutomate both isolation and remediation without any human intervention to speed up response.
   • CAutomate the isolation step, then pause the workflow and wait for manual approval before proceeding with remediation.
   • DRequire manual approval before isolation, then automate remediation.
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   A security operations team is designing a SOAR playbook for phishing email triage. The team wants to reduce analyst workload while maintaining human oversight for actions that could have significant business impact. Which approach best balances automation with human intervention?

   • AAutomate the entire playbook, including quarantining mailboxes and deleting emails, to maximize efficiency and reduce analyst fatigue.
   • BRequire manual analyst confirmation for every step, including enrichment and indicator retrieval, to ensure complete control over the incident response process.
   • CAutomate all steps except the final report generation, which is left manual to preserve the analyst's ability to document the incident accurately.
   • DAutomate low-risk enrichment and containment steps, but require analyst approval before executing any action that quarantines a mailbox or blocks a sender.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company wants to integrate their SOAR platform with a legacy security appliance that only supports a proprietary command-line interface (CLI) and has no documented API. What is the most practical approach to achieve orchestration with this appliance?

   • AManually perform actions on the legacy appliance and document them in the SOAR platform.
   • BDevelop a custom integration script that uses the CLI to execute commands and parse the output.
   • CReplace the legacy appliance with a modern tool that has a full API.
   • DUse the SOAR platform's built-in generic API connector, assuming it can handle any system.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is evaluating whether to automate the process of quarantining infected endpoints. The process is performed about 200 times per month, takes 15 minutes each time, and requires a high level of accuracy to avoid disrupting business operations. Which factor is most important when assessing the feasibility of automating this process?

   • AThe process is already accurate, so automation would not improve it.
   • BThe process is high-volume and time-consuming, making it a strong candidate for automation.
   • CThe process is too risky to automate because it could disrupt business operations.
   • DThe process is too complex to automate because it requires decision-making.
   Reveal Solution Discussion Select an answer first