6.4 Explain the Functions of Security Orchestration, Automation, and Response (SOAR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   During a major incident, the incident response team is using SOAR to coordinate. The team lead wants to ensure that all actions taken by analysts are logged and that the incident timeline is accurate for post-incident review. However, some analysts are performing actions directly in the security tools (e.g., blocking an IP in the firewall) without going through the SOAR platform. What is the best way to ensure a complete audit trail?

   • AUse SOAR integrations to pull logs from the security tools to correlate actions with the incident timeline.
   • BDisable direct access to security tools during the incident.
   • CRequire all analysts to perform actions only through the SOAR platform.
   • DManually record all actions in the SOAR case management system after the incident.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does SOAR enhance consistency in security operations?

   • ABy providing a chat interface for analysts to communicate
   • BBy storing all incident data in a single database
   • CBy ensuring that every incident is handled using the same predefined playbook
   • DBy allowing each analyst to handle incidents in their own preferred way
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is designing a SOAR playbook for malware response. The playbook should automatically isolate the affected host, collect forensic evidence, and notify the incident response lead. However, the team is concerned that automatic isolation could disrupt critical business operations if the host is a production server. What is the best way to handle this in the playbook?

   • AAutomatically isolate only non-production hosts and skip isolation for production servers.
   • BDo not automate isolation; always require manual isolation by an analyst.
   • CInclude a conditional step that checks if the host is a production server and, if so, requires manual approval before isolation.
   • DAutomatically isolate all hosts, including production servers, to contain the threat quickly.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which activity is an example of SOAR's response function?

   • APerforming a vulnerability scan on a new server
   • BCollecting and storing logs from multiple sources
   • CCreating a new user account in Active Directory
   • DAutomatically isolating an infected endpoint from the network
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team uses a SIEM that generates thousands of alerts daily, a ticketing system for incident tracking, and an endpoint detection and response (EDR) tool. Analysts manually copy alert details from the SIEM into tickets and then open the EDR console to check affected hosts. The team wants to reduce this repetitive work and ensure every alert is consistently enriched with EDR data before a ticket is created. What should they implement first?

   • AA custom script that runs on the SIEM server to export all alerts to a CSV file for analysts to review.
   • BA new SIEM correlation rule that reduces the number of alerts by grouping similar events into a single incident.
   • CA new policy requiring analysts to check the EDR before opening any ticket.
   • DA SOAR playbook that ingests SIEM alerts, queries the EDR for host information, and automatically opens a ticket with the enriched data.
   Reveal Solution Discussion Select an answer first