2.18 Recommend Procedural and SOAR Workflows from the Described Issue Through Escalation and the Automation Needed for Resolution 350-201 Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A company's SOAR platform receives an alert from the SIEM about a suspicious login. The playbook enriches the alert with threat intelligence and checks the user's risk score. If the risk score is high, the playbook triggers a multi-factor authentication (MFA) challenge. Which integration is required for the MFA challenge?

   • ASOAR to ticketing system integration.
   • BSOAR to identity provider (IdP) integration.
   • CSOAR to firewall integration.
   • DSIEM to threat intelligence platform integration.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOAR playbook is designed to respond to malware alerts. Which response action is the most appropriate to automate?

   • ADeciding whether to involve law enforcement.
   • BIsolating the infected endpoint from the network.
   • CDetermining the root cause of the infection.
   • DCommunicating with the affected user.
   Reveal Solution Discussion Select an answer first