A security team wants to automate the creation of incident tickets in their existing ITSM tool. Which integration should they add to the playbook?

A vulnerability scanner integration

A ticketing system integration (e.g., ServiceNow, Jira)

A threat intelligence platform integration

A security team is designing a playbook for automated containment of a worm that spreads via SMB. The playbook must isolate infected endpoints and block the SMB port on the firewall. The team has an EDR tool and a firewall management system. They want to minimize the time to containment. What should they do?

Integrate the EDR tool and the firewall management system into the playbook

Use manual containment procedures

Integrate only the firewall management system

A security team notices that their SOAR platform does not have a playbook for a common alert type. What is this an example of?

A performance issue in the SOAR platform

A gap in the orchestration that should be filled with a new playbook

A false positive in the detection rules

A security analyst is reviewing a response playbook for a malware infection. Which step is the BEST candidate for full automation?

Communicating the incident status to executive leadership

Determining the business impact of the infected system

Collecting the file hash and querying a threat intelligence service for reputation

Deciding whether to isolate the host or just kill the process

What is the purpose of performing a gap analysis on a SOAR implementation?

To replace the SOAR platform with a different vendor

To increase the number of alerts generated by the SIEM

To identify missing or inefficient automations and recommend improvements

To reduce the number of security analysts on the team

Google CloudProfessional Security Operations Engineer

Domain 5Objective 2

5.2 Building, Implementing, and Using Response Playbooks PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Part of the Incident response domain, which accounts for 21% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

23questions here

5free pages

6concepts

21%of the exam

Questions 6–10

6foundation · easy
A security team wants to automate the creation of incident tickets in their existing ITSM tool. Which integration should they add to the playbook?
Select an answer first
7expert · hard
A security team is designing a playbook for automated containment of a worm that spreads via SMB. The playbook must isolate infected endpoints and block the SMB port on the firewall. The team has an EDR tool and a firewall management system. They want to minimize the time to containment. What should they do?
Select an answer first
8foundation · easy
A security team notices that their SOAR platform does not have a playbook for a common alert type. What is this an example of?
Select an answer first
9foundation · easy
A security analyst is reviewing a response playbook for a malware infection. Which step is the BEST candidate for full automation?
Select an answer first
10foundation · easy
What is the purpose of performing a gap analysis on a SOAR implementation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.