6.6 Explain Security Orchestration, Automation, and Response (SOAR) and Security Information and Event Management (SIEM) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of a Security Information and Event Management (SIEM) system?

   • ATo automatically respond to security incidents without human intervention
   • BTo collect, correlate, and analyze security event data from across the organization
   • CTo provide a secure channel for communication between security analysts
   • DTo replace the need for traditional antivirus software on endpoints
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How do SOAR and SIEM typically work together in a security operations workflow?

   • ASIEM generates alerts from analyzed data, and SOAR executes automated response actions based on those alerts
   • BSOAR sends logs to SIEM for storage and analysis
   • CSOAR replaces SIEM in modern security operations centers
   • DSIEM uses SOAR to collect logs from endpoints
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team wants to automate the response to a specific type of alert: a malware detection on an endpoint. The desired response is to isolate the endpoint, kill the malicious process, and then create a ticket. However, the team is concerned about the risk of isolating a critical server that might be a false positive. Which SOAR capability can help mitigate this risk?

   • AA playbook that isolates the endpoint only if the alert severity is critical.
   • BA playbook that only creates a ticket and does not perform any automated actions.
   • CA playbook that includes a manual approval step before executing the isolation action.
   • DA playbook that automatically isolates the endpoint and then notifies the team.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst needs to investigate a potential data exfiltration incident. The analyst wants to search for all outbound network connections from a specific server to an external IP address over the past 30 days. Which SIEM capability is most directly used to perform this search?

   • AThreat intelligence feed integration
   • BAutomated playbook execution
   • CLog management and search
   • DUser and entity behavior analytics (UEBA)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A small company has a limited security team and wants to improve its security posture. They currently have no centralized logging, and incident response is done manually. They need to start by gaining visibility into what is happening across their network and systems. Which technology should they implement first?

   • AFirewall with logging
   • BSIEM
   • CEDR
   • DSOAR
   Reveal Solution Discussion Select an answer first