4.5 Determine Opportunities for Automation, Orchestration, and Machine Learning Within a SOAR Platform 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to use machine learning to improve their SOAR platform's ability to prioritize incidents. They have historical data on past incidents, including the final outcome (true positive vs. false positive). Which ML approach would best enable the SOAR platform to automatically prioritize new incidents?

   • AUse a simple heuristic that prioritizes incidents with more affected users.
   • BTrain a supervised learning model on the historical data to classify new incidents as high or low priority.
   • CUse unsupervised learning to cluster incidents without using the historical outcome labels.
   • DImplement a rule-based scoring system that assigns points based on alert type and source.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC team manually reviews firewall logs each morning to identify failed login attempts from external IPs. They then cross-reference the IPs with a threat intelligence feed and block the malicious ones. This process takes two hours daily. What is the most effective automation opportunity?

   • AAutomate the blocking of all external IPs that appear in the logs.
   • BAutomate the retrieval of firewall logs, enrichment with threat intel, and blocking of malicious IPs via the SOAR platform.
   • CUse a machine learning model to predict which IPs will be malicious without any threat intel enrichment.
   • DAutomate only the threat intel lookup and leave the blocking manual.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations team receives hundreds of daily alerts from their EDR, most of which are false positives triggered by legitimate software updates. Analysts manually review each alert, check the hash against a threat intel feed, and close it. The team wants to reduce analyst workload without risking missed true positives. Which approach best applies SOAR automation to this scenario?

   • AUse machine learning to predict which alerts are false positives and automatically suppress them without any human review.
   • BAutomate the hash lookup and enrichment for all alerts, but leave the final disposition decision to the analyst for every alert.
   • CCreate a playbook that automatically quarantines any endpoint associated with an alert that matches a known-good software update pattern.
   • DAutomate the entire alert triage process, including closure, for all alerts matching a known-good software update pattern, and escalate all others for human review.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses separate tools for ticketing, threat intelligence, and endpoint response. When an incident is confirmed, analysts manually copy indicators from the threat intel portal, create a ticket, and then run containment commands on the affected endpoints. The team wants to streamline this process. What is the most effective use of SOAR orchestration?

   • ACreate a workflow that automatically opens a ticket, enriches the incident with threat intel, and initiates containment on affected endpoints when triggered by a confirmed incident.
   • BUse a SOAR playbook that only sends an email notification to the analyst when an incident is confirmed, leaving all actions manual.
   • CReplace the ticketing system with the SOAR platform's built-in case management to eliminate the need for integration.
   • DManually export indicators from the threat intel portal and import them into the SOAR platform for each incident.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is evaluating two processes for automation: (1) blocking malicious IPs from firewall logs, which occurs 500 times per month and takes 5 minutes each, and (2) investigating a complex multi-stage attack, which occurs 5 times per month and takes 4 hours each. The team has limited development resources. Which process should they prioritize for automation?

   • AAutomate both processes simultaneously to maximize efficiency.
   • BAutomate the attack investigation first because it saves more time per incident.
   • CAutomate the IP blocking process first because it is high-volume and rule-based, providing quick ROI.
   • DDo not automate either process because the team has limited resources.
   Reveal Solution Discussion Select an answer first