Security Orchestration Automation and Response GASAE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team wants to use SOAR to automate the initial triage of all alerts. The team wants the SOAR to automatically categorize alerts based on severity and type, and then assign them to the appropriate analyst group. Which SOAR use case best describes this scenario?

   • AAutomated response, because the SOAR is taking a response action on the alerts.
   • BIncident triage, because the SOAR is automatically categorizing and prioritizing alerts for analyst review.
   • COrchestration, because the SOAR is coordinating multiple tools.
   • DThreat hunting, because the SOAR is proactively searching for threats.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC is implementing a SOAR platform to automate incident response. The team has identified that a significant number of alerts are false positives, but they are concerned that automating responses might cause them to miss true positives. The team wants to reduce the time spent on false positives while maintaining a high level of accuracy. Which approach best balances these competing concerns?

   • AAutomate only the response actions for low-severity alerts and keep high-severity alerts fully manual.
   • BKeep all response actions manual and use the SOAR only for reporting and metrics.
   • CAutomate the triage and enrichment of all alerts, but require human approval for any response action that is disruptive or irreversible.
   • DAutomate all response actions for all alerts to maximize efficiency and reduce the time spent on false positives.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which element is typically included in a SOAR workflow to allow human intervention when necessary?

   • AA machine learning model that predicts future attacks
   • BA log rotation policy that automatically deletes old logs
   • CA manual approval step that pauses the workflow until an analyst approves or rejects an action
   • DA network segmentation rule that isolates all devices automatically
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOAR platform is being configured to support incident response. The platform will need to collect data from multiple sources, execute response actions, and track the status of incidents. Which set of SOAR components is required to achieve these capabilities?

   • AA dashboard, a report generator, and a notification system.
   • BIntegrations, playbooks, and case management.
   • CAn API gateway, a database, and a web server.
   • DA SIEM, a ticketing system, and a threat intelligence platform.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is designing a SOAR workflow for malware containment. The workflow must isolate an infected endpoint, but the team is concerned about the risk of isolating a critical server that is not actually infected. The workflow should include a verification step before isolation. Which workflow design best balances automation speed with the need for verification?

   • ARun a verification scan first, and if the scan confirms infection, automatically isolate the endpoint.
   • BIsolate the endpoint only if the threat intelligence score is above a high threshold, without any further verification.
   • CAutomatically isolate the endpoint, then run a verification scan, and if the scan is negative, rejoin the endpoint to the network.
   • DIsolate the endpoint only after a human analyst manually reviews the alert and approves the isolation.
   Reveal Solution Discussion Select an answer first