Security Orchestration Automation and Response GASAE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is designing a SOAR workflow for incident response. The workflow must automatically gather information about a user from the identity provider, check the user's risk score, and then either escalate the incident or close it. The team wants to ensure that the workflow is easy to maintain and update. Which workflow design principle is most important to follow?

   • AUse modular, reusable workflow components that can be updated independently without affecting other parts of the workflow.
   • BUse a separate workflow for each integration to keep the logic isolated.
   • CCreate a single, monolithic workflow that handles all possible scenarios to avoid complexity.
   • DHardcode all the integration details directly into the workflow to avoid external dependencies.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary benefit of integrating a SOAR platform with a ticketing system?

   • AIt replaces the need for a SIEM by providing log correlation
   • BIt allows the ticketing system to perform automated threat hunting
   • CIt enables automatic creation and updating of incident tickets based on SOAR-triggered events
   • DIt allows the SOAR platform to send emails to end users for phishing simulations
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team receives a large number of low-severity alerts from endpoint detection and response (EDR) tools. Most alerts are false positives, but a few indicate real malware infections. The team wants to reduce the time spent on false positives while ensuring that real infections are escalated. Which SOAR use case best addresses this need?

   • AAutomated response that immediately quarantines any endpoint that generates an alert.
   • BAutomated reporting that summarizes all alerts at the end of the day for manual review.
   • CAutomated incident triage that enriches alerts with threat intelligence and applies a scoring model to prioritize or dismiss them.
   • DAutomated threat hunting that proactively searches for indicators of compromise across the environment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which scenario best illustrates a common SOAR use case for incident triage?

   • ADeploying a honeypot to attract attackers and gather intelligence
   • BManually reviewing each alert in a queue and deciding whether to escalate it to a senior analyst
   • CConducting a post-incident review to document lessons learned
   • DAutomatically enriching an alert with threat intelligence and assigning a priority score based on predefined criteria
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOAR platform needs to integrate with a legacy ticketing system that only supports email-based ticket creation. The SOAR platform does not have a built-in connector for this system. What is the most effective way to integrate with the legacy system?

   • AUse a third-party middleware that only supports REST APIs.
   • BReplace the legacy ticketing system with a modern one that has a SOAR connector.
   • CUse a custom integration that sends an email to the ticketing system's email-to-ticket gateway.
   • DManually copy alert details into the ticketing system.
   Reveal Solution Discussion Select an answer first