Security Orchestration Automation and Response GASAE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security operations center (SOC) is considering a SOAR platform to reduce alert fatigue. The SOC handles a high volume of low-fidelity alerts but also a small number of complex incidents that require deep investigation. The team is concerned that over-automation might cause them to miss subtle indicators. Which implementation strategy best balances automation benefits with the risk of missing complex threats?

   • AAutomate only the high-severity alerts and leave all low-severity alerts for manual review.
   • BAutomate only the repetitive, low-risk triage tasks and require human analysis for any alert that does not match a known pattern.
   • CKeep all workflows manual and use the SOAR platform only for reporting and metrics.
   • DAutomate all possible response actions to maximize efficiency and reduce the need for manual intervention.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team is using SOAR for automated threat hunting. The playbook queries the SIEM for indicators of compromise (IOCs) and then automatically blocks any IP addresses that are found. However, the team is concerned about false positives blocking legitimate traffic. What is the best way to mitigate this risk?

   • ADisable the automated blocking and only generate reports.
   • BAutomatically block all IPs found, regardless of impact.
   • CAdd a validation step that requires a human analyst to approve blocking actions for high-impact IPs.
   • DOnly block IPs that are on a pre-approved blocklist.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC manager is considering a SOAR platform to improve incident response. The team currently uses a SIEM, a ticketing system, and a threat intelligence platform. The manager wants to reduce the time analysts spend on repetitive tasks. Which SOAR benefit is most directly aligned with this goal?

   • AImproved threat intelligence sharing across the organization.
   • BAutomation of repetitive tasks, such as data enrichment and ticket creation, which reduces manual effort.
   • CIncreased visibility into the security posture of the organization.
   • DEnhanced compliance reporting capabilities.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC is implementing a SOAR platform to improve incident response. The team has identified that a significant amount of time is spent on gathering context for each alert, such as user information, asset criticality, and threat intelligence. The team wants to reduce this time. Which SOAR capability directly addresses this challenge?

   • AReporting, which generates metrics on incident response times.
   • BCase management, which tracks the status of the incident and assigns tasks to analysts.
   • COrchestration, which automates the process of gathering context from multiple tools and presenting it in a single view.
   • DAutomated response, which automatically takes action on the alert without human intervention.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How does a SOAR platform typically integrate with a SIEM?

   • AThe SOAR platform ingests alerts from the SIEM and enriches them with additional context for automated response
   • BThe SIEM uses the SOAR platform to perform vulnerability scans on the network
   • CThe SOAR platform replaces the SIEM by providing its own log storage and correlation engine
   • DThe SIEM sends raw logs to the SOAR platform for long-term storage
   Reveal Solution Discussion Select an answer first