2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is designing a playbook for handling a data breach involving customer personal data. The playbook must include steps for containment, eradication, recovery, and notification. The legal team requires that any notification to external parties be approved by a senior manager. The playbook should also automatically escalate the incident to the incident commander if the breach involves more than 1,000 customer records. Which playbook design meets these requirements?

   • AA linear playbook that performs containment, eradication, recovery, and notification in sequence, with no manual steps.
   • BA playbook with automated containment, eradication, and recovery, a manual approval step before external notification, and a conditional escalation to the incident commander based on record count.
   • CA playbook that immediately escalates to the incident commander for all data breaches, and then waits for manual instructions for all subsequent actions.
   • DA playbook that automates the external notification and escalates to the incident commander only if the breach is confirmed to be malicious.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company wants to implement a SOAR platform to streamline incident response. The platform must automatically create tickets, enrich alerts with threat intelligence, and execute response actions across multiple security tools. Which component is essential for this integration?

   • AA manual ticketing process for every alert.
   • BA separate SIEM platform for each security tool.
   • CA set of connectors or APIs to integrate with the existing tools.
   • DA dedicated physical server for each security tool.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is designing a SOAR playbook for responding to a ransomware outbreak. The playbook must automatically isolate all affected endpoints, but the business continuity team requires that isolation of servers in the production environment be manually approved because it could disrupt critical services. The playbook must also escalate to the incident commander if more than 10 endpoints are affected. The SOAR platform can integrate with the EDR to isolate endpoints. Which playbook design best balances automation and human oversight?

   • AAutomatically isolate all endpoints, including production servers, and escalate to the incident commander if more than 10 endpoints are affected.
   • BRequire manual approval for all endpoint isolations, and escalate to the incident commander only if the incident is confirmed as ransomware.
   • CAutomatically isolate all endpoints, and do not escalate to the incident commander unless the business continuity team requests it.
   • DAutomatically isolate user endpoints, but require manual approval for production servers, and escalate to the incident commander if more than 10 endpoints are affected.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which condition is most likely to be used as a threshold to trigger a SOAR workflow?

   • AThe number of security tools deployed in the environment
   • BThe name of the security analyst on duty
   • CThe day of the week
   • DAn alert severity level of 'high' or above
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC manager is evaluating the performance of a SOAR workflow that automatically quarantines malicious files and creates tickets. The manager wants to determine if the automation is actually saving time compared to the previous manual process. Which metric should the manager compare between the manual and automated processes?

   • AThe number of false positives generated by the SIEM.
   • BThe number of security incidents detected per month.
   • CThe total number of tickets created in the ticketing system.
   • DThe average time from alert detection to containment.
   Reveal Solution Discussion Select an answer first