2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team is designing a playbook for phishing email incidents. The playbook should automatically quarantine the email, but it must also allow an analyst to decide whether to block the sender domain. Which design best incorporates the human decision?

   • AQuarantine the email and block the sender domain without any manual steps.
   • BAutomatically block the sender domain and then quarantine the email.
   • CAutomatically quarantine the email and then pause the workflow for analyst approval before blocking the sender domain.
   • DOnly quarantine the email and never block the sender domain.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security manager wants to evaluate the effectiveness of the incident escalation procedure. Which key performance indicator (KPI) is most relevant?

   • APercentage of alerts that are false positives.
   • BTotal number of incidents closed in a month.
   • CMean time to escalate (MTTE) from initial detection to higher-tier response.
   • DNumber of security tools deployed in the environment.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's SOAR platform is integrated with its SIEM, threat intelligence platform (TIP), and ticketing system. The SOC team wants to create a workflow that automatically checks new alerts against the TIP for known malicious indicators, and if a match is found, automatically blocks the indicator on the firewall and creates a ticket. Which integration is essential for the workflow to automatically block the indicator on the firewall?

   • AIntegration with the SIEM to receive the alert.
   • BIntegration with the threat intelligence platform to check the indicator.
   • CIntegration with the ticketing system to create the ticket.
   • DIntegration with the firewall to execute the block action.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a SOAR workflow, when is a human-in-the-loop decision point typically required?

   • AWhen the alert is generated by a SIEM
   • BWhen an action has significant business impact or requires legal approval
   • CWhen the workflow is triggered by a low-severity alert
   • DWhen the workflow is running for the first time
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   How does automating response actions primarily benefit an incident response team?

   • AIt ensures that all incidents are resolved without human oversight
   • BIt reduces manual effort and accelerates resolution of routine incidents
   • CIt guarantees that no false positives occur
   • DIt eliminates the need for security analysts
   Reveal Solution Discussion Select an answer first