6.4 Explain the Functions of Security Orchestration, Automation, and Response (SOAR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does SOAR typically integrate with a SIEM?

   • ASOAR sends all its data to the SIEM for storage and analysis
   • BSOAR and SIEM are separate systems that do not interact
   • CSOAR replaces the SIEM as the primary log management system
   • DSOAR receives alerts from the SIEM and executes automated response actions
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC is implementing a SOAR platform. They want to ensure that when an alert is confirmed as a true positive, the platform automatically opens a ticket, assigns it to the appropriate analyst, and sends a notification to the team. Which SOAR component is primarily responsible for these actions?

   • AAutomation capabilities that execute predefined workflows.
   • BOrchestration capabilities that integrate with the SIEM.
   • CPlaybooks that define the steps, but they require manual execution.
   • DResponse capabilities that provide case management.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to proactively search for indicators of compromise (IOCs) across their environment. They have a list of known malicious IP addresses and domains. They want to automatically check these IOCs against their firewall logs, DNS logs, and endpoint data, and then create an incident if a match is found. Which SOAR use case does this describe?

   • AIncident investigation
   • BAlert triage
   • CThreat hunting
   • DVulnerability management
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the role of a playbook in a SOAR platform?

   • ATo replace the need for any human decision-making during an incident
   • BTo provide a graphical user interface for analysts to view alerts
   • CTo store historical incident data for reporting and analytics
   • DTo define a standardized set of steps and actions to handle a specific type of incident
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During an active ransomware incident, the incident response team uses SOAR to coordinate their efforts. They need to ensure that all communication between team members is logged, that the status of the incident is updated in real-time, and that containment actions are tracked. Which SOAR feature is most important for this coordination?

   • AIntegration with the firewall for automated blocking
   • BCase management with collaboration and audit logging
   • CA playbook that automatically contains the threat without human input
   • DAutomated threat intelligence enrichment
   Reveal Solution Discussion Select an answer first