Security Orchestration Automation and Response GASAE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common SOAR use case for automated response?

   • AConducting a security awareness training session for employees
   • BGenerating a weekly report of all security incidents for management review
   • CPerforming a manual forensic analysis of a compromised system
   • DAutomatically isolating an infected endpoint from the network when a malware alert is confirmed
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key benefit of implementing SOAR in a security operations center (SOC)?

   • AIt eliminates the need for security analysts by fully automating all incident response
   • BIt reduces the time to respond to incidents by automating repetitive tasks and coordinating tools
   • CIt guarantees that all security incidents are prevented before they occur
   • DIt provides a single source for all log storage and analysis
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOAR platform is integrated with a SIEM and a ticketing system. The SIEM sends alerts to the SOAR platform, which creates tickets. However, the SIEM is generating a high volume of duplicate alerts, causing ticket flooding. The SOC wants to reduce duplicates without losing important alerts. What is the best approach?

   • AImplement a deduplication logic in the SOAR playbook that groups similar alerts within a time window before creating a ticket.
   • BCreate a separate ticket for every alert, even duplicates.
   • CIncrease the SIEM's alert threshold to reduce the number of alerts.
   • DDisable the SIEM integration and manually create tickets.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC wants to automatically create a ticket in ServiceNow whenever the SIEM generates a high-severity alert. The SOAR platform is already connected to the SIEM. What is the most efficient way to implement this integration?

   • AUse a custom script on a server to read SIEM logs and write directly to the ServiceNow database.
   • BHave the SOAR platform poll ServiceNow for new alerts and then create tickets.
   • CCreate a SOAR playbook triggered by the SIEM alert that calls the ServiceNow API to create the ticket.
   • DConfigure the SIEM to send an email to the SOC manager who manually creates the ticket.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team wants to use SOAR to automate the response to a specific type of malware that is known to be low-risk. The desired response is to isolate the affected host and send a notification to the IT team. Which SOAR capability is most directly used to implement this?

   • AIncident ticketing to create a record of the event.
   • BThreat intelligence enrichment to gather more data about the malware.
   • CAutomated response playbooks that execute predefined actions on the host and send notifications.
   • DReporting and dashboarding to visualize the malware's spread.
   Reveal Solution Discussion Select an answer first