2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · easy

   A SOAR platform is configured to run a playbook when a SIEM alert contains a specific indicator of compromise (IOC). The playbook automatically blocks the IOC on the firewall and sends a notification to the security team. Which element is the workflow trigger?

   • AThe SIEM alert containing the IOC.
   • BThe notification sent to the security team.
   • CThe firewall block action.
   • DThe SOAR platform's playbook configuration.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's SOAR platform receives an alert for a user account that has attempted to authenticate 15 times in 5 minutes from an unusual geographic location. The playbook is designed to automatically disable the account and reset the password. However, the account belongs to a senior executive. What is the best approach?

   • AConfigure the playbook to require manual approval before disabling the account.
   • BAutomatically disable the account because the playbook is triggered by the alert.
   • CIgnore the alert because the account is a senior executive and the risk is low.
   • DAutomatically reset the password but leave the account enabled.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does a SOAR platform typically integrate with a SIEM to enhance incident response?

   • ABy ingesting alerts from the SIEM to trigger automated workflows
   • BBy providing a separate dashboard for SIEM alerts
   • CBy replacing the SIEM's log storage capabilities
   • DBy sending all security logs to the SOAR platform for analysis
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company's SOAR playbook automatically blocks IP addresses that are associated with a confirmed intrusion. However, the playbook has blocked a legitimate partner's IP address, causing a business outage. The team wants to prevent this from happening again. What is the best approach?

   • ADisable the automated blocking feature entirely.
   • BMaintain an allowlist of known partner IP addresses and check it before blocking.
   • CRequire analyst approval for all IP blocks in the playbook.
   • DBlock the IP address for a shorter duration to reduce the impact.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's incident response policy defines escalation criteria based on the number of affected users and the criticality of the affected system. The policy states that an incident must be escalated to the next tier if it affects more than 50 users OR if it involves a system classified as 'mission-critical'. A SOC analyst is handling an incident that affects 30 users on a system classified as 'business-essential' but not 'mission-critical'. The analyst has contained the incident and is confident it will not spread. What should the analyst do?

   • AEscalate to the next tier because the system is 'business-essential', which is close to 'mission-critical'.
   • BEscalate to the next tier because the analyst is confident it will not spread, which indicates a low-risk incident that needs higher-tier review.
   • CDo not escalate and handle the incident at the current tier, documenting the actions taken.
   • DEscalate to the next tier because the incident affects 30 users, which is a significant number.
   Reveal Solution Discussion Select an answer first