6.4 Explain the Functions of Security Orchestration, Automation, and Response (SOAR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In which scenario would a SOAR platform be most beneficial?

   • AAn organization needs to store large amounts of log data for regulatory compliance
   • BA company wants to encrypt all data in transit between its offices
   • CAn organization needs to manage employee access to cloud applications
   • DA security team receives a high volume of alerts and needs to quickly identify and respond to genuine threats
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a security incident, the incident response team uses a SOAR platform. The team lead wants to ensure that all actions taken by different analysts are documented, that the incident status is visible to management, and that the final report is automatically generated. Which SOAR capability is most directly responsible for this?

   • AAutomated threat intelligence enrichment
   • BOrchestration of firewall rule changes
   • CIntegration with the SIEM for log correlation
   • DCase management and collaboration features
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How do workflows in SOAR contribute to security operations?

   • AThey define the sequence of actions and conditions that automate a security process
   • BThey provide a repository for storing threat intelligence feeds
   • CThey allow analysts to manually execute each step of an incident response
   • DThey replace the need for a SIEM to correlate events
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary function of orchestration in a SOAR platform?

   • ATo store and index security logs for compliance and reporting
   • BTo integrate and coordinate multiple security tools and processes so they work together as a unified workflow
   • CTo provide a user interface for analysts to manually enter incident data
   • DTo replace the need for security analysts by making all decisions automatically
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team receives a high volume of alerts from their SIEM. Many are false positives that require manual review. The team wants to reduce the time analysts spend on false positives while ensuring that true positives are not missed. What is the most effective SOAR approach?

   • AAutomatically close all low-severity alerts without review.
   • BIncrease the SIEM threshold to generate fewer alerts.
   • CAutomate the enrichment of all alerts and only escalate those that meet certain criteria to analysts.
   • DManually review every alert to ensure no true positive is missed.
   Reveal Solution Discussion Select an answer first