4.5 Determine Opportunities for Automation, Orchestration, and Machine Learning Within a SOAR Platform 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses a SOAR platform to orchestrate incident response. They want to automatically create a ticket in their ITSM tool, block the malicious IP in their firewall, and send a notification to the incident responder when a phishing alert is confirmed. What is the primary benefit of using orchestration for this process?

   • AIt reduces the time to respond by automatically coordinating actions across multiple tools.
   • BIt eliminates the need for human involvement in incident response.
   • CIt replaces the need for a SIEM by centralizing all security data.
   • DIt ensures that all security tools use the same API format.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC receives a large volume of alerts that are individually low severity but may indicate a coordinated attack when viewed together. Analysts are overwhelmed and often miss these patterns. Which machine learning capability in a SOAR platform would best address this issue?

   • AAnomaly detection that identifies deviations from normal network behavior and groups related alerts into a single incident.
   • BA rule-based engine that triggers a playbook when a specific combination of alerts occurs.
   • CAutomated patch management that updates vulnerable systems based on alert data.
   • DA dashboard that displays all alerts in a single view for manual review.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to use machine learning to reduce the number of false positive alerts in their SOAR platform. They have a large dataset of historical alerts that were manually classified as true or false positives. Which ML approach would be most effective?

   • AImplement a rule-based filter that blocks alerts from known false positive sources.
   • BUse unsupervised clustering to group similar alerts and manually review each cluster.
   • CTrain a supervised classification model on the historical data to automatically classify new alerts as true or false positives.
   • DUse a simple heuristic that flags alerts as false positives if they come from a specific IP range.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team manually reviews all alerts from their SIEM and creates a ticket for each one. They find that 80% of the alerts are low severity and require no action. The team wants to reduce the noise. Which automation opportunity is most appropriate?

   • AUse machine learning to predict which alerts are low severity and automatically delete them from the SIEM.
   • BAutomate the triage of low-severity alerts by correlating them with threat intel and closing them if no malicious indicators are found.
   • CIncrease the SIEM's alert threshold to reduce the number of alerts generated.
   • DAutomate the creation of tickets for all alerts, including low-severity ones, to ensure nothing is missed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is considering automating the process of resetting user passwords after a phishing incident. The process occurs about 10 times per month, takes 30 minutes each time, and requires manual verification of the user's identity. Which factor most strongly supports automating this process?

   • AThe process is repetitive and rule-based, even though it occurs infrequently.
   • BThe process is already efficient and error-free, so automation would not provide significant ROI.
   • CThe process is too complex to automate because it involves multiple steps.
   • DThe process requires human judgment to verify identity, which cannot be automated.
   Reveal Solution Discussion Select an answer first