SIEM and SOAR CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOAR playbook is triggered by a SIEM alert for a possible compromised account. The playbook is supposed to (1) disable the account, (2) reset the password, and (3) notify the user. However, the playbook fails at step 2 because the password reset API is temporarily unavailable. What is the best practice for handling this failure?

   • ADesign the playbook with error handling that retries the password reset, and if it continues to fail, escalates to a human analyst
   • BDisable the playbook permanently until the API is fixed
   • CLet the playbook continue to the next step and notify the user that the password was reset
   • DStop the playbook and do nothing further
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which component is a typical part of a SIEM architecture?

   • AA load balancer that distributes incoming web traffic
   • BA log collector that ingests data from various sources
   • CA web application firewall that filters HTTP requests
   • DA vulnerability scanner that patches operating systems
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the incident response process, which phase involves identifying whether an alert is a real incident?

   • APreparation
   • BContainment, Eradication, and Recovery
   • CDetection and Analysis
   • DPost-Incident Activity
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations center (SOC) receives hundreds of alerts daily. Analysts spend most of their time on repetitive tasks like checking IP reputation and opening tickets. The SOC manager wants to reduce this workload while keeping human oversight for critical decisions. Which approach is most effective?

   • AUse a ticketing system that automatically closes all alerts after 24 hours
   • BConfigure the SIEM to suppress all low-priority alerts
   • CIncrease the number of SOC analysts to handle the alert volume
   • DDeploy a SOAR platform to automate enrichment and ticketing, with playbooks that pause for human approval before destructive actions
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does a SOAR playbook typically execute an automated response action?

   • ABy calling an API of a connected security tool to perform the action
   • BBy sending an email to the system administrator for manual action
   • CBy rewriting the firewall rules manually in the configuration file
   • DBy physically disconnecting the server from the network
   Reveal Solution Discussion Select an answer first