2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOAR playbook automatically quarantines emails that contain a known malicious attachment. The playbook also automatically deletes the emails from all user mailboxes. Which step should be added to incorporate a human-in-the-loop decision?

   • ASend an email to the affected users asking if they want the emails deleted.
   • BQuarantine the emails but do not delete them.
   • CRequire analyst approval before permanently deleting the emails.
   • DAutomatically delete the emails without any manual step.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security operations center (SOC) has an escalation procedure that escalates incidents to Tier 2 when the severity is high or above. A SOAR platform is configured to automatically escalate alerts with a severity score above 80. Recently, the SOC has seen an increase in Tier 2 workload due to false positives. What is the best way to reduce the false-positive escalations?

   • AIncrease the severity threshold to 90 so fewer alerts are escalated.
   • BLower the SOAR severity threshold to 70 so more alerts are escalated for review.
   • CDisable the SOAR automation and rely on manual escalation.
   • DAdd a validation step in the SOAR workflow to enrich alerts with threat intelligence before escalation.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How can a SOAR workflow incorporate a manual step into an otherwise automated process?

   • ABy automatically executing the action and then asking for forgiveness
   • BBy pausing the workflow and sending a notification to a human for approval
   • CBy skipping the manual step and logging it for later review
   • DBy requiring the human to manually run the entire workflow
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which response action is most suitable for full automation in a SOAR workflow?

   • ABlocking a known malicious IP address at the firewall
   • BDetermining the root cause of a complex intrusion
   • CApproving a change to a critical production system
   • DDeciding whether to notify law enforcement about a breach
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company's SOAR platform integrates with a SIEM and a threat intelligence platform. The SIEM sends an alert for a suspicious domain. The SOAR playbook enriches the alert with threat intelligence and then automatically blocks the domain on the DNS server. However, the DNS server integration is not working, and the block fails. What is the best way to handle this failure?

   • AConfigure the playbook to retry the DNS block and, if it fails, escalate to a human analyst.
   • BIgnore the failure and continue the playbook.
   • CAutomatically block the domain on the firewall instead.
   • DStop the playbook and do not block the domain.
   Reveal Solution Discussion Select an answer first