Security Orchestration Automation and Response GASAE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst receives a phishing alert from the SIEM. The SOAR platform has a playbook that enriches the email with threat intelligence, checks the user's risk score, and then either blocks the sender or creates a ticket. The analyst notices that when the threat intelligence lookup times out, the playbook fails and no ticket is created. What should the analyst configure to ensure the playbook completes even when the enrichment service is unavailable?

   • AIncrease the timeout on the threat intelligence API integration to allow more time for the lookup to complete.
   • BConfigure the SIEM to suppress phishing alerts until the threat intelligence service is confirmed healthy.
   • CRemove the threat intelligence enrichment step from the playbook entirely to avoid the timeout.
   • DAdd an error-handling branch that logs the failure and proceeds to the risk-score check using cached or default values.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a core component of a SOAR platform?

   • AA firewall management interface for configuring network rules
   • BA playbook engine that executes predefined workflows
   • CA log aggregation engine that collects and indexes all network traffic
   • DA vulnerability scanner that identifies weaknesses in applications
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which statement best describes the role of Security Orchestration, Automation, and Response (SOAR) in modern security operations?

   • ASOAR replaces the need for human analysts by fully automating all security decisions.
   • BSOAR is a framework for classifying security incidents based on severity and impact.
   • CSOAR primarily focuses on collecting and correlating log data from multiple sources for real-time monitoring.
   • DSOAR integrates security tools and automates workflows to streamline incident response and other security operations.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team wants to use SOAR to automate the response to a specific type of alert: a user clicking a link in a phishing email. The team wants the SOAR to automatically disable the user's account and then notify the incident response team. Which SOAR use case best describes this scenario?

   • AAutomated response, because the SOAR is taking a predefined action (disabling the account) without manual intervention.
   • BIncident triage, because the SOAR is prioritizing the alert and deciding whether to escalate.
   • CThreat hunting, because the SOAR is proactively searching for indicators of compromise.
   • DOrchestration, because the SOAR is coordinating multiple tools to gather context.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is manually reviewing a large number of alerts from a new SIEM integration. The alerts are all similar and require the same initial investigation steps. Which SOAR feature would be most effective to reduce the analyst's workload?

   • ADisable the SIEM integration until the alert volume decreases.
   • BIncrease the SIEM's alert threshold to reduce the number of alerts.
   • CAssign a dedicated analyst to manually investigate each alert.
   • DCreate a playbook that automatically performs the initial investigation steps and enriches the alert with context.
   Reveal Solution Discussion Select an answer first