6.6 Explain Security Orchestration, Automation, and Response (SOAR) and Security Information and Event Management (SIEM) CYBERSECURITY-APPRENTICE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC manager wants to provide weekly metrics to the CISO showing the number of security incidents detected, the types of attacks, and the average time to detect. Which SIEM capability is most directly used to produce this information?

   • AReporting and dashboarding
   • BThreat hunting
   • CLog retention
   • DAutomated response
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a SIEM that generates an alert for a potential ransomware infection. The SOC wants to automatically contain the threat by isolating the affected endpoint and blocking the command-and-control (C2) IP in the firewall. However, the team is concerned about the accuracy of the alert and wants to avoid disrupting business operations. Which approach best balances automation and risk?

   • AAutomatically isolate the endpoint and block the IP without any additional validation.
   • BUse a SOAR playbook that enriches the alert with threat intelligence, and if the C2 IP is confirmed malicious, automatically isolate the endpoint and block the IP.
   • CManually investigate every alert before taking any action.
   • DBlock the IP in the firewall but do not isolate the endpoint.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to reduce the time it takes to respond to phishing emails reported by users. Currently, an analyst manually checks the email headers, queries the threat intelligence platform, and then blocks the sender in the email gateway. The team wants to automate these steps so that when a user reports a phishing email, the process runs automatically. Which SOAR component is specifically used to define and execute this automated process?

   • ALog aggregator
   • BCorrelation engine
   • CDashboard
   • DPlaybook
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a common use case for SIEM?

   • AAutomatically containing a malware outbreak on endpoints
   • BExecuting playbooks to isolate compromised hosts
   • COrchestrating a response across multiple security tools
   • DGenerating compliance reports by analyzing collected log data
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security architect is designing a new SOC. The organization has a limited budget and must choose between implementing a SIEM or a SOAR platform first. The primary requirement is to improve threat detection and compliance reporting. Which approach is most appropriate?

   • AImplement both simultaneously, because they are equally essential from day one.
   • BImplement a SIEM first, because it provides the log collection, correlation, and reporting needed for detection and compliance.
   • CImplement a SOAR first, because it can automate detection and reporting without a SIEM.
   • DImplement a firewall with logging first, because it provides both detection and reporting.
   Reveal Solution Discussion Select an answer first