Security Orchestration Automation and Response GASAE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company uses a SIEM for log aggregation, a ticketing system for incident tracking, and a threat intelligence platform (TIP) for indicator feeds. The SOC wants to automatically enrich every phishing alert with reputation data from the TIP and create a ticket only if the reputation score exceeds a threshold. Which SOAR integration approach should be used?

   • AConfigure the TIP to send enrichment data directly to the ticketing system, bypassing the SOAR.
   • BConfigure the SIEM to directly create a ticket in the ticketing system and include the TIP data in the alert payload.
   • CConfigure the ticketing system to poll the SIEM for alerts and call the TIP API for enrichment.
   • DConfigure the SOAR to trigger on SIEM alerts, call the TIP API for enrichment, and conditionally create a ticket in the ticketing system.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC manager wants to integrate a threat intelligence platform (TIP) with the SOAR platform to enrich alerts. The TIP provides a REST API that requires an API key. What is the best practice for storing and using this API key in the SOAR platform?

   • AStore the API key as a secret in the SOAR platform's credential vault and reference it in the playbook.
   • BShare the API key with all analysts via a shared document.
   • CHardcode the API key in the playbook code for simplicity.
   • DUse the API key in the SIEM query to enrich alerts directly.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC is evaluating whether to build a SOAR playbook for a complex incident response process that involves multiple teams and tools. The playbook would automate many steps, but the process is not well-documented and changes frequently. What is the primary risk of automating this process?

   • AThe playbook will require too many approvals, slowing down the response.
   • BThe playbook will not be able to integrate with all the necessary tools.
   • CThe playbook may become outdated quickly and require frequent maintenance, leading to high operational overhead.
   • DThe playbook will be too slow for real-time response.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is designing a SOAR playbook for a critical alert that requires approval from a senior analyst before blocking a user account. The playbook should pause and wait for approval, but if the approval is not received within 10 minutes, it should escalate to the SOC manager. What is the best way to implement this in the SOAR workflow?

   • AAutomatically block the account without approval to save time.
   • BUse a manual approval step with a timeout that triggers an escalation action.
   • CSend an email to the senior analyst and wait indefinitely for a response.
   • DSkip the approval step and only notify the SOC manager after the action is taken.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOAR playbook is designed to handle a malware outbreak. The first step quarantines the affected endpoint, the second step collects forensic artifacts, and the third step notifies the incident response team. The playbook is currently set to run all steps in parallel. What is the main problem with this configuration?

   • AThe notification to the incident response team will be delayed.
   • BThe forensic collection may fail if the endpoint is quarantined before collection starts.
   • CThe playbook will consume too many API calls from the endpoint protection tool.
   • DThe playbook will not be able to create a ticket in the ticketing system.
   Reveal Solution Discussion Select an answer first