2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a typical incident escalation procedure, what is the primary purpose of defining escalation criteria before an incident occurs?

   • ATo eliminate the need for human decision-making during incidents
   • BTo ensure that all incidents are handled by the most senior analyst available
   • CTo provide a consistent and timely response based on the incident's severity and impact
   • DTo document every action taken during an incident for compliance purposes
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst receives an alert for a single workstation beaconing to a known command-and-control domain. The alert is rated medium severity. The analyst checks the host and finds no evidence of persistence or data exfiltration. According to the incident escalation procedure, the next step is to escalate to the Tier 2 team. Which action should the analyst take first?

   • AClose the alert as a false positive because no persistence was found.
   • BDocument the findings and escalate the incident to Tier 2 with the available evidence.
   • CWait for the alert to auto-escalate after a 24-hour period.
   • DContain the host by isolating it from the network before escalating.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When designing a procedural playbook for incident response, what is the primary purpose of including decision points?

   • ATo allow the playbook to adapt to different conditions or findings during the incident
   • BTo provide a list of all possible response actions
   • CTo document the roles and responsibilities of each team member
   • DTo ensure that every incident follows the exact same sequence of actions
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst detects a ransomware outbreak affecting multiple servers. The incident is declared critical. According to the escalation procedure, the analyst must escalate to the incident commander. What should the analyst do before escalating?

   • AGather available evidence and document the scope of the incident.
   • BClose the incident as a false positive if the ransomware is not spreading.
   • CWait for the SOAR playbook to automatically escalate the incident.
   • DContain all affected servers before escalating.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations center (SOC) receives thousands of low-fidelity alerts daily from its SIEM. The team wants to reduce alert fatigue by having the SOAR platform automatically enrich alerts with threat intelligence, suppress known false positives, and open a ticket only for alerts that match a specific MITRE ATT&CK technique. The SOAR platform is already integrated with the SIEM, threat intelligence feed, and ticketing system. Which configuration should the team implement to meet these requirements?

   • ADisable all SIEM alerts except those for the target technique, and configure the SOAR platform to automatically open a ticket for every received alert.
   • BSet the SIEM to only forward alerts that match the target technique, and have the SOAR platform perform enrichment and ticketing without suppression logic.
   • CConfigure a workflow trigger with a condition that filters for the target MITRE technique, then run enrichment and suppression actions before opening a ticket.
   • DCreate a single playbook triggered by all SIEM alerts that enriches, suppresses, and opens a ticket for every alert.
   Reveal Solution Discussion Select an answer first