SIEM and SOAR CSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In a SOAR platform, what is a playbook?

   • AA document that lists all security tools in the organization
   • BA predefined set of automated steps to respond to a specific type of incident
   • CA log of all past security incidents
   • DA list of approved software vendors
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A SIEM correlation rule is designed to detect a potential brute-force attack by counting failed login attempts per source IP. The rule currently triggers an alert after 5 failed attempts within 10 minutes. The security team is overwhelmed by alerts from a few legitimate users who frequently mistype passwords. They want to reduce false positives without missing distributed brute-force attacks that use many different source IPs. What is the best approach?

   • AIncrease the threshold to 20 failed attempts within 10 minutes
   • BCreate a second rule that detects failed attempts across many source IPs for a single user account, and lower the threshold for that rule
   • CAdd a condition that requires failed attempts from the same source IP against multiple user accounts
   • DDisable the correlation rule and rely on endpoint detection and response (EDR) alerts
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has both a SIEM and a SOAR platform. The SIEM detects a potential data exfiltration event and creates an alert. What is the most effective way for the SOAR platform to handle this alert?

   • ASend the alert to a ticketing system and close it without further action
   • BWait for the SIEM to automatically contain the endpoint before creating a ticket
   • CAutomatically trigger a playbook that enriches the alert, contains the affected endpoint, and notifies the incident response team
   • DManually copy the alert details into a SOAR case and run a playbook later
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SIEM correlation rule is designed to detect a potential data exfiltration by alerting when a user uploads more than 100 MB of data to an external cloud storage service within 10 minutes. The rule is generating a high number of false positives because some users regularly upload large files as part of their job. The security team wants to reduce false positives without missing real exfiltration. Which approach is most effective?

   • AIncrease the threshold to 500 MB to reduce the number of alerts
   • BAdd a rule that alerts only when the upload occurs outside business hours
   • CDisable the rule and rely on manual monitoring of upload logs
   • DRefine the rule to include a baseline of normal behavior for each user and alert only when the upload deviates significantly from the baseline
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company's SIEM receives firewall logs that record source IPs in dotted-decimal format and proxy logs that record them as integers. The security team wants to correlate a single source IP across both log types to detect a scanning campaign. What must be configured first?

   • AA parsing and normalization policy that converts both IP formats into a common schema
   • BAn alert action that sends both raw log formats to the security analyst for manual review
   • CA SOAR playbook that enriches the IP address before the SIEM indexes the logs
   • DA correlation rule that references the raw source IP field from both log sources
   Reveal Solution Discussion Select an answer first