6.6 Explain Security Orchestration, Automation, and Response (SOAR) and Security Information and Event Management (SIEM) CYBERSECURITY-APPRENTICE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a key difference between SOAR and SIEM in terms of their primary functions?

   • ASOAR focuses on automating and orchestrating incident response, while SIEM focuses on collecting and analyzing security event data
   • BSOAR is used for compliance reporting, while SIEM is used for threat intelligence sharing
   • CSOAR focuses on collecting and storing logs, while SIEM focuses on automating responses
   • DSOAR is a type of firewall, while SIEM is a type of endpoint protection
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SOC uses a SIEM to detect a potential brute-force attack on a VPN gateway. The SIEM creates an alert, but the SOC wants to automatically block the attacking IP address in the firewall and notify the on-call engineer. Which technology should be used to perform these automated actions?

   • ASOAR
   • BVulnerability scanner
   • CSIEM
   • DConfiguration management database (CMDB)
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following best describes the role of SOAR in a security operations center?

   • AIt replaces the need for other security tools like firewalls and endpoint protection
   • BIt enables security teams to automate response actions and coordinate workflows across different security tools
   • CIt provides a platform for security analysts to manually review and triage every alert
   • DIt acts as a central repository for all security logs and alerts
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In an integrated SOAR and SIEM environment, what is the typical data flow during an incident response?

   • ASIEM sends raw logs to SOAR, and SOAR stores them for compliance
   • BSOAR generates alerts from network traffic, and SIEM responds by blocking the attacker
   • CSIEM generates an alert, SOAR enriches it with additional context, and then executes a response playbook
   • DSOAR collects raw logs, sends them to SIEM, and SIEM automatically remediates the incident
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is evaluating tools to reduce the mean time to respond (MTTR) to security incidents. They have a SIEM that generates alerts, but the response process is manual and involves multiple teams. They want to automate the initial triage and containment actions. Which technology is specifically designed to address this need?

   • AFirewall
   • BSOAR
   • CSIEM
   • DTicketing system
   Reveal Solution Discussion Select an answer first