SIEM and SOAR CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary goal of Security Orchestration, Automation, and Response (SOAR)?

   • ATo replace human security analysts entirely
   • BTo collect and store logs from all network devices
   • CTo encrypt all data in transit across the network
   • DTo automate and streamline incident response processes
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SIEM correlation rule detects a potential data exfiltration event when a user uploads more than 1 GB of data to an external cloud storage service within an hour. The rule generates many alerts for legitimate users who regularly back up data. The security team wants to reduce false positives while still detecting unusual exfiltration. What is the best approach?

   • ADisable the rule and rely on data loss prevention (DLP) tools
   • BCreate a baseline of normal upload behavior for each user and alert only when the upload deviates significantly from the baseline
   • CAdd a condition that requires the upload to occur outside normal business hours
   • DIncrease the threshold to 10 GB per hour
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOAR playbook is designed to respond to a malware alert. The first step enriches the alert with threat intelligence, the second step isolates the affected host, and the third step creates a ticket. The playbook fails at the second step because the host isolation API returns an error. What should the playbook do?

   • AIgnore the error and mark the playbook as successful
   • BStop the playbook and leave the ticket uncreated
   • CContinue to the next step and create the ticket, noting the isolation failure
   • DRetry the isolation step indefinitely until it succeeds
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a SIEM that generates a high volume of low-fidelity alerts. They are deploying a SOAR platform to automate response. The security team is concerned that the SOAR playbooks might act on false positives and cause disruption. What is the most effective way to balance automation with safety?

   • AConfigure the SOAR to only create tickets and never take any automated action
   • BUse a risk-based approach where playbooks run automatically for high-confidence alerts and require human approval for lower-confidence alerts
   • CDisable all SOAR automation and have analysts manually respond to every alert
   • DConfigure the SOAR to automatically run playbooks on all alerts without human approval
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's SIEM ingests logs from cloud access security broker (CASB) and identity provider (IdP) sources. The CASB logs use a field named 'user' with the format 'jdoe', while the IdP logs use 'userPrincipalName' with the format 'jdoe@company.com'. The security team wants to correlate a single user's activity across both sources. They have limited SIEM processing capacity and cannot afford to store duplicate data. What is the most effective approach?

   • AStore both raw logs and create a separate lookup table that maps usernames to email addresses
   • BIngest only the IdP logs and ignore the CASB logs to avoid the format mismatch
   • CCreate a correlation rule that matches on the first part of the IdP userPrincipalName and the CASB user field
   • DConfigure a normalization policy that maps both fields to a common 'user' field using a transformation rule
   Reveal Solution Discussion Select an answer first