6.6 Explain Security Orchestration, Automation, and Response (SOAR) and Security Information and Event Management (SIEM) CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a core component of SIEM?

   • ALog management
   • BPlaybook execution
   • CThreat intelligence sharing
   • DAutomated containment
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of the 'correlation' component in a SIEM system?

   • ATo store logs for compliance purposes
   • BTo automatically block malicious IP addresses
   • CTo provide a user interface for analysts to manually review logs
   • DTo combine and analyze events from different sources to identify patterns of attack
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a common use case for SOAR?

   • ACorrelating authentication logs to detect brute-force attacks
   • BStoring log data for forensic analysis
   • CProviding a real-time dashboard of network traffic
   • DAutomating the response to phishing emails by quarantining them across email gateways
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC analyst is investigating a potential data breach. The analyst needs to determine if any user accounts were compromised by searching for successful logins from unusual locations. The SIEM has logs from VPN, Active Directory, and cloud applications. Which SIEM capability is most directly used to identify these unusual logins?

   • AReporting on total login counts per user.
   • BLog retention policies that store logs for 90 days.
   • CAlerting on any login failure.
   • DCorrelation of login events across multiple sources with geolocation data.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of security orchestration, automation, and response (SOAR) in a security operations center?

   • ATo provide a real-time dashboard of network traffic and system health
   • BTo automate and orchestrate security operations, such as incident response workflows and threat containment
   • CTo replace the need for human security analysts in the SOC
   • DTo collect and store log data from various sources for later analysis
   Reveal Solution Discussion Select an answer first