2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is designing a playbook for responding to a suspected insider threat. The playbook must include steps for data collection, user interview, and potential account suspension. The legal team requires that the user interview be conducted by a human, and the account suspension must be approved by the HR department. The playbook should also automatically escalate to the security director if the user has access to sensitive data. Which playbook design correctly incorporates these requirements?

   • AAutomate data collection, the user interview, and account suspension, and escalate to the security director if the user has sensitive data access.
   • BAutomate data collection, require a manual step for the user interview, require HR approval for account suspension, and escalate to the security director if the user has sensitive data access.
   • CAutomate data collection and the user interview, and require HR approval for account suspension.
   • DRequire manual steps for data collection and the user interview, and automate the account suspension with HR notification.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which element is typically included in a well-designed incident response playbook?

   • AA summary of all past incidents and their outcomes
   • BA list of specific steps, decision points, and assigned roles
   • CA detailed explanation of every security control in the organization
   • DA list of all employees and their contact information
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which metric is most commonly used to measure the efficiency of a SOAR workflow?

   • ANumber of analysts on the team
   • BNumber of security tools integrated
   • CMean time to respond (MTTR)
   • DTotal number of alerts generated per day
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst detects a potential ransomware infection on a single workstation. The alert is rated as medium severity. The company's incident response policy states that medium-severity incidents must be escalated to the incident commander if they involve a specific high-value asset or if the analyst cannot contain the threat within 30 minutes. The workstation is a standard user device, and the analyst successfully isolates it from the network within 10 minutes. What should the analyst do next?

   • AEscalate to the incident commander because the analyst successfully contained the threat, which indicates a sophisticated attack.
   • BEscalate to the incident commander because the alert is medium severity and requires immediate higher-tier review.
   • CClose the incident as a false positive because the workstation was isolated successfully.
   • DContinue with the standard playbook for medium-severity incidents and document the containment actions taken.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a SOAR platform, what is the primary function of the 'automation' component?

   • ATo generate reports for management review
   • BTo replace the need for security analysts entirely
   • CTo provide a centralized repository for all security logs
   • DTo execute predefined response actions automatically without manual intervention
   Reveal Solution Discussion Select an answer first