Apply Automation and Orchestration ZERO-TRUST-DESIGN Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations center uses a SIEM for log aggregation and a separate ticketing system for incident tracking. Analysts currently copy alert details from the SIEM into tickets manually. The team wants to automate this process. What is the most effective way to integrate these tools?

   • AAsk analysts to use a browser extension that auto-fills ticket fields from the SIEM.
   • BHave analysts use a shared spreadsheet to track alerts instead of the ticketing system.
   • CSet up a scheduled email that sends alert summaries to the ticketing system's inbox.
   • DConfigure the SIEM to automatically create tickets in the ticketing system via API when an alert is triggered.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which statement best describes the role of orchestration in a Zero Trust security operations center?

   • AIt replaces the need for security analysts by making all decisions automatically.
   • BIt coordinates multiple automated tools and processes to respond to incidents in a structured manner.
   • CIt is primarily used to generate compliance reports for auditors.
   • DIt focuses on automating a single repetitive task, such as log rotation.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the role of a SOAR platform in relation to automation and orchestration?

   • AIt provides a platform to design, automate, and orchestrate incident response workflows.
   • BIt is a type of firewall that filters malicious traffic.
   • CIt is a protocol for encrypting data in transit.
   • DIt is a database used to store threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is creating an automated incident response playbook for a suspected ransomware infection. The playbook must contain the spread, preserve evidence, and notify stakeholders. However, the team is concerned about the playbook accidentally isolating a critical production server. What is the best way to handle this risk?

   • AInclude a pre-check in the playbook that identifies critical systems and requires manual approval before isolating them.
   • BExclude all servers from automated isolation and only isolate end-user workstations.
   • CRun the playbook only during off-hours to minimize business impact.
   • DAutomate isolation of all affected systems immediately to stop the spread as fast as possible.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of an automated incident response playbook in a Zero Trust environment?

   • ATo store evidence for legal proceedings.
   • BTo provide a step-by-step automated response to a specific type of incident.
   • CTo document the incident response process for auditors.
   • DTo replace the need for human incident responders entirely.
   Reveal Solution Discussion Select an answer first