Security Orchestration Automation and Response GASAE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a SOAR platform, what is the primary function of the 'automation' component?

   • ATo store all security logs for long-term retention
   • BTo provide a graphical interface for analysts to manually enter incident details
   • CTo generate executive reports on security posture
   • DTo execute repetitive tasks without human intervention based on predefined rules or playbooks
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC manager is evaluating a SOAR platform to improve incident response times. The team currently spends a significant amount of time on manual data gathering and repetitive tasks. The manager is concerned about the initial setup effort and the need for ongoing maintenance. Which evaluation factor is most important to consider when deciding whether to implement SOAR?

   • AThe number of analysts that will be required to operate the SOAR on a daily basis.
   • BThe potential reduction in manual effort and incident response time compared to the cost and effort of building and maintaining the workflows.
   • CThe ability of the SOAR to replace the SIEM and ticketing system entirely.
   • DThe number of security tools the SOAR can integrate with, regardless of whether those tools are currently in use.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A small SOC is considering implementing SOAR. They have a limited budget and a small team. They want to automate a few repetitive tasks but are concerned about the complexity of maintaining playbooks. What is the most important factor to consider before implementation?

   • AThe total cost of ownership, including licensing, integration, and ongoing maintenance effort.
   • BThe ability to generate reports for management.
   • CThe speed of automated response compared to manual response.
   • DThe number of security tools that can be integrated.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is designing a SOAR workflow for phishing response. The workflow must check the email's sender domain against a threat intelligence feed, and if the domain is malicious, quarantine the email. If the domain is not malicious, the workflow should still notify an analyst for review. The team is concerned about the reliability of the threat intelligence feed and wants to avoid quarantining legitimate emails due to a feed outage. Which workflow design best addresses this concern?

   • AAlways quarantine the email and then notify an analyst for review.
   • BAdd a check for the threat intelligence feed's availability; if the feed is unavailable, route the email to an analyst for manual review instead of quarantining.
   • CQuarantine the email only if the threat intelligence feed returns a 'malicious' verdict, and ignore any errors.
   • DQuarantine the email if the domain is not found in the threat intelligence feed, assuming it is malicious.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOAR platform needs to pull alerts from a SIEM and also push indicators of compromise (IOCs) to a threat intelligence platform. What is the recommended way to achieve this bidirectional integration?

   • AManually export alerts from the SIEM and import them into the threat intelligence platform.
   • BWrite custom scripts for each direction and run them on a separate server.
   • CUse the SIEM's API to push IOCs directly to the threat intelligence platform.
   • DUse the SOAR platform's built-in connectors for both the SIEM and the threat intelligence platform.
   Reveal Solution Discussion Select an answer first