2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary benefit of integrating a ticketing system with a SOAR platform?

   • AIt allows analysts to bypass security controls
   • BIt replaces the need for a SIEM
   • CIt provides real-time threat intelligence feeds
   • DIt automatically creates and updates tickets for incidents, ensuring proper tracking
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is designing a playbook for a suspected data exfiltration incident. The playbook must automatically isolate the affected endpoint and reset the user's credentials. However, the endpoint is a critical file server used by multiple departments. The team wants to avoid unnecessary disruption. What is the best design?

   • AAutomatically isolate the endpoint and reset credentials, then notify the departments.
   • BRequire analyst approval before isolating the endpoint, but automatically reset the user's credentials.
   • CAutomatically isolate the endpoint but require approval before resetting credentials.
   • DDo not automate any actions; require manual response for all steps.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations manager wants to measure the effectiveness of a SOAR playbook that automates the containment of infected endpoints. Which metric best indicates the playbook's efficiency?

   • AMean time to contain (MTTC) for affected endpoints.
   • BNumber of endpoints in the environment.
   • CTotal number of alerts generated by the SIEM.
   • DNumber of security analysts on the team.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to automate the initial triage of alerts from their SIEM. They want the SOAR platform to enrich each alert with threat intelligence and create a ticket in their ticketing system. Which integration is required for this workflow?

   • ASIEM to SOAR, SOAR to threat intelligence platform, and SOAR to ticketing system.
   • BThreat intelligence platform to ticketing system and SIEM to threat intelligence platform.
   • CSIEM to ticketing system and threat intelligence platform to SIEM.
   • DOnly SIEM to SOAR, because SOAR can automatically create tickets without a ticketing integration.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In a SOAR workflow, what is a common trigger that initiates an automated response?

   • AA change in the organization's firewall policy
   • BA scheduled time of day
   • CA manual request from a security analyst
   • DA specific alert type from a SIEM
   Reveal Solution Discussion Select an answer first