Security Orchestration Automation and Response GASAE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of the 'orchestration' component in a SOAR platform?

   • ATo store historical incident data for compliance reporting
   • BTo replace the need for human analysts in incident response
   • CTo connect and coordinate actions across multiple security tools and systems
   • DTo generate real-time alerts based on log correlation rules
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common challenge when implementing SOAR in a SOC?

   • ASOAR platforms require significant upfront investment in hardware and are not available as cloud services
   • BSOAR platforms automatically replace the need for a SIEM, making log analysis obsolete
   • CSOAR platforms can generate a large number of false positives if workflows are not properly designed
   • DSOAR platforms are unable to integrate with any third-party security tools
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC wants to automate the initial triage of phishing emails. The playbook should extract URLs from the email, check them against a URL reputation service, and if the URL is malicious, block it on the email gateway. The playbook should also create a ticket for any email that is not clearly benign. What is the best way to design this workflow?

   • AAlways block the sender and create a ticket for every email.
   • BSkip the URL reputation check and block all emails with URLs.
   • CUse a conditional branch: if the URL reputation is malicious, block the sender; otherwise, create a ticket for manual review.
   • DAlways create a ticket and never block the sender automatically.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of a SOAR workflow (playbook)?

   • ATo replace the need for human analysts in all security operations
   • BTo define a set of steps and actions that are executed automatically in response to a specific event or condition
   • CTo provide a graphical dashboard for monitoring network traffic in real time
   • DTo store raw logs from all security devices for compliance purposes
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is planning to implement SOAR to reduce alert fatigue. They have a high volume of low-fidelity alerts that require manual triage. Which SOAR use case would directly address this problem?

   • AAutomated incident triage that enriches alerts and applies a risk score to prioritize them.
   • BAutomated user training that sends phishing simulations to employees.
   • CAutomated threat hunting that scans for indicators of compromise across the network.
   • DAutomated patch management that updates vulnerable systems.
   Reveal Solution Discussion Select an answer first