6.6 Explain Security Orchestration, Automation, and Response (SOAR) and Security Information and Event Management (SIEM) CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a security operations context, which statement correctly contrasts SOAR and SIEM?

   • ASIEM provides real-time alerting on security events, while SOAR executes automated workflows to respond to those alerts
   • BSIEM is used for network traffic analysis, while SOAR is used for endpoint detection
   • CSOAR is a subset of SIEM and does not require separate deployment
   • DSIEM is primarily used for automated response, while SOAR is used for log management
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has a SIEM that generates a high volume of alerts, many of which are false positives. The security team is overwhelmed and wants to reduce alert fatigue while ensuring that real threats are not missed. They also want to automate the initial investigation of each alert. Which approach best addresses both concerns?

   • AUse a SOAR platform to automatically triage alerts, enrich them with threat intelligence, and filter out false positives before presenting them to analysts.
   • BDisable all alerts and rely on manual log review.
   • CIncrease the SIEM's alert threshold to reduce the number of alerts generated.
   • DHire more analysts to manually investigate every alert.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a SOAR platform, what does the 'automation' component primarily enable?

   • AThe visualization of security metrics on a dashboard
   • BThe collection of logs from multiple sources
   • CThe correlation of events to detect attacks
   • DThe execution of predefined response actions without manual intervention
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC uses a SIEM that generates an alert for every failed login attempt. The team is overwhelmed by the volume and wants to reduce noise while ensuring that a brute-force attack is not missed. They plan to implement a SOAR platform. Which SOAR playbook logic best addresses this challenge?

   • AA playbook that sends every failed login alert to a ticketing system for manual review.
   • BA playbook that aggregates failed login attempts by source IP and user account, and only escalates if the count exceeds a threshold within a time window.
   • CA playbook that disables the user account after the first failed login.
   • DA playbook that automatically blocks the source IP after a single failed login attempt.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team wants to integrate their SIEM with a SOAR platform. The goal is to automatically enrich alerts with threat intelligence and then, if the alert is confirmed as malicious, block the associated IP in the firewall. Which SOAR capability is primarily used to define this conditional workflow?

   • APlaybooks
   • BCase management
   • CThreat intelligence platform
   • DDashboards
   Reveal Solution Discussion Select an answer first