SIEM and SOAR CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations team wants to reduce the time spent on phishing alerts. They plan to use SOAR to automatically quarantine a suspicious email and block the sender, but they are concerned about acting without human review. What is the most appropriate approach?

   • AConfigure a fully automated playbook that quarantines and blocks without any manual step
   • BUse a playbook that only sends an email to the user warning them not to click the link
   • CCreate a playbook that enriches the email with threat intelligence and then waits for analyst approval before taking action
   • DDisable the SIEM alert and rely on manual triage of all phishing reports
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to automate the response to low-severity alerts so analysts can focus on critical incidents. They have a SIEM that generates alerts and a ticketing system. What should they implement to achieve this?

   • AA manual process where analysts review and close low-severity alerts at the end of each day
   • BA firewall rule that blocks all traffic from low-severity alert sources
   • CA SOAR platform that runs playbooks to triage and resolve low-severity alerts automatically
   • DA new SIEM correlation rule that automatically closes low-severity alerts
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an incident, the response team needs to collect forensic evidence from a compromised server. They want to ensure the evidence is preserved and documented for potential legal action. Which step in the incident response workflow is most critical at this point?

   • AImmediately reboot the server to clear any malicious processes
   • BPreserve the server's memory and disk images using forensically sound methods
   • CDelete the server's logs to prevent the attacker from covering tracks
   • DNotify the attacker that they have been detected
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   When a SIEM generates an alert, what does that alert typically indicate?

   • AThe log source is no longer sending data
   • BA confirmed security breach has occurred
   • CA predefined condition or rule has been matched
   • DThe SIEM has automatically remediated the issue
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small business wants to implement a SIEM to meet a compliance requirement that mandates log retention and review. They have limited budget and IT staff. Which deployment model is most appropriate?

   • AA SIEM that only collects logs from the compliance-critical system
   • BAn on-premises SIEM deployed on dedicated hardware
   • CA cloud-based SIEM service that is managed by the vendor
   • DA custom-built SIEM using open-source components and in-house development
   Reveal Solution Discussion Select an answer first