SIEM and SOAR CSE Practice Questions (Page 9)

Questions 41–42

1. 41foundation · easy

   How can SOAR support the containment phase of incident response?

   • ABy automatically isolating an infected host from the network
   • BBy writing a post-incident report
   • CBy analyzing root cause after the incident
   • DBy conducting employee security awareness training
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC uses a SIEM for detection and a SOAR for response. An alert is triggered for a possible data exfiltration. The SOAR playbook automatically blocks the user's access and creates a ticket. However, the playbook does not notify the incident response manager. What is the most likely gap in the integration?

   • AThe incident response manager is not a user in the SOAR platform
   • BThe playbook lacks a step to send a notification to the incident response manager
   • CThe SIEM failed to send the alert to the SOAR platform
   • DThe SOAR platform does not support notifications
   Reveal Solution Discussion Select an answer first