6.6 Explain Security Orchestration, Automation, and Response (SOAR) and Security Information and Event Management (SIEM) CYBERSECURITY-APPRENTICE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a core component of SOAR?

   • AOrchestration
   • BLog aggregation
   • CReporting dashboards
   • DCorrelation rules
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a core function of a SIEM system?

   • APerforming vulnerability scans on network devices
   • BManaging user access and permissions across the network
   • CAutomating incident response playbooks
   • DCorrelating events from different sources to identify potential security incidents
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial institution must provide auditors with a monthly report showing all authentication failures and successful logins across its on-premises and cloud systems. The report must include timestamps, source IPs, and user accounts. Which technology is best suited to generate this report?

   • AA log management tool that only stores raw logs without any correlation or reporting capabilities.
   • BAn endpoint detection and response (EDR) tool, because it tracks user logins and can export reports.
   • CSIEM, because it aggregates logs from multiple sources and provides reporting and compliance features.
   • DSOAR, because it can automate the collection of logs from all systems and generate custom reports.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations center (SOC) receives thousands of raw logs per second from network devices and servers. Analysts are overwhelmed by the volume and are missing critical security events because they cannot identify patterns across the logs. Which SIEM capability is most directly intended to address this problem?

   • AReporting
   • BAlerting
   • CLog retention
   • DCorrelation
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst at a mid-sized company spends most of the day manually reviewing raw firewall and endpoint logs to identify potential threats. The analyst then has to manually copy relevant log entries into a ticket and email the incident responder. The company wants to reduce the analyst's manual workload and speed up the detection-to-response cycle. Which solution directly addresses the analyst's stated pain points?

   • ADeploy a next-generation firewall with advanced threat prevention to block malicious traffic before it reaches the network.
   • BDeploy a SIEM to collect and correlate logs, automatically generate alerts, and provide a centralized dashboard for investigation.
   • CDeploy a SOAR platform to automate the entire incident response process, including log analysis, alert generation, and ticket creation.
   • DDeploy a SIEM for log correlation and a SOAR platform to automate the response workflow, including ticket creation and notification.
   Reveal Solution Discussion Select an answer first