2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   A security analyst detects a potential ransomware infection on a single workstation. According to a typical incident escalation procedure, which factor most directly determines whether the incident should be escalated to a higher-tier responder?

   • AThe time of day the incident occurred
   • BThe severity and potential impact of the incident
   • CThe number of security tools that generated alerts
   • DThe analyst's personal comfort level with the incident type
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC analyst is handling an incident where a phishing email bypassed the email gateway and was delivered to several users. The incident is classified as low severity. The company's escalation policy states that low-severity incidents should be escalated to the next tier if they involve a VIP user or if the same phishing campaign is reported more than five times in a day. The analyst finds that the email was delivered to three users, none of whom are VIPs, and this is the first report of this campaign. What should the analyst do?

   • AEscalate to the next tier because the email bypassed the email gateway, which indicates a critical infrastructure failure.
   • BClose the incident as a false positive because the email was delivered to only a few users.
   • CHandle the incident at the current tier and follow the standard low-severity playbook.
   • DEscalate to the next tier because three users received the email, which is a significant number.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC manager wants to measure the effectiveness of a new SOAR workflow that automatically enriches alerts with threat intelligence and creates tickets. The manager needs to know if the workflow is reducing the time spent on each alert and if the enrichment is actually useful. The SOAR platform is integrated with the SIEM and ticketing system. Which set of metrics should the manager track to evaluate these goals?

   • ANumber of alerts that triggered the workflow and the total number of tickets created in the ticketing system.
   • BMean time to acknowledge (MTTA) and the number of tickets closed by the SOC team.
   • CMean time to resolve (MTTR) and the percentage of alerts that were enriched successfully.
   • DAverage time from alert creation to ticket creation, and the percentage of tickets where the enriched threat intelligence was used to make a decision.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which statement best describes the role of the 'orchestration' component in a SOAR platform?

   • AIt stores and manages threat intelligence feeds for the organization
   • BIt coordinates and integrates multiple security tools and processes to work together in a workflow
   • CIt automatically executes response actions without any human involvement
   • DIt provides a dashboard for security analysts to view alerts
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which KPI would best indicate the effectiveness of an escalation procedure?

   • APercentage of incidents escalated within the target time
   • BNumber of SOAR workflows deployed
   • CAverage age of security analysts
   • DTotal number of security incidents per month
   Reveal Solution Discussion Select an answer first