SOC Tools and Technology GSOM Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SOC manager wants to automate the response to a specific type of alert. The SOAR playbook would automatically block an IP address at the firewall. However, the firewall team is concerned about false positives causing legitimate business disruption. What is the best way to address this concern while still gaining automation benefits?

   • ADisable the automation and require manual blocking for all alerts
   • BBlock the IP for a short time and then automatically unblock
   • CAutomatically block the IP and rely on the firewall team to review later
   • DConfigure the playbook to require a two-person approval before executing the block
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC is evaluating a new SOAR platform. The team wants to automate incident response actions such as blocking IPs and isolating endpoints. Which additional evaluation criterion is most important to ensure the SOAR can actually perform these actions?

   • AThe number of playbook templates included
   • BThe SOAR's reporting dashboard
   • CPre-built integrations with the existing firewall and EDR products
   • DThe vendor's training program
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A SOC uses a SOAR platform to automate the creation of tickets in the ticketing system when a SIEM generates an alert. What is the primary benefit of this integration?

   • AIt replaces the need for analyst review of alerts.
   • BIt eliminates the need for a SIEM.
   • CIt ensures that all alerts are false positives.
   • DIt reduces manual data entry and speeds up the response workflow.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC is evaluating a new SOAR platform. The team has limited scripting skills and relies heavily on vendor support. The platform must integrate with the existing SIEM and ticketing system. Which evaluation criterion should be weighted most heavily?

   • AThe platform's ability to run on-premises
   • BThe vendor's market share
   • CThe speed of the platform's automation engine
   • DThe number of pre-built integrations and playbook templates
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC manager wants to automate the containment of a confirmed compromised host. The team has an EDR platform that supports API-based isolation. Which step is essential before enabling automated isolation?

   • AReplace the EDR with a next-generation firewall
   • BDefine a playbook that specifies the trigger conditions and approval steps for isolation
   • CIncrease the SIEM retention period
   • DDisable the EDR's manual isolation feature
   Reveal Solution Discussion Select an answer first