6.4 Explain the Functions of Security Orchestration, Automation, and Response (SOAR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which statement best describes the scope of SOAR in a security operations center (SOC)?

   • AIt is a type of firewall that provides deep packet inspection and intrusion prevention
   • BIt encompasses the orchestration of security tools, automation of workflows, and coordinated response to incidents
   • CIt focuses exclusively on detecting malware on endpoints using signature-based scanning
   • DIt is a framework for managing user identities and access permissions across the organization
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's security operations are overwhelmed by the volume of alerts, and analysts often miss critical incidents because they are busy with low-priority alerts. The CISO wants to improve the team's ability to focus on high-priority threats. Which statement best describes how SOAR can help?

   • ASOAR automates the triage of low-priority alerts, allowing analysts to focus on high-priority incidents.
   • BSOAR only works with SIEM tools and cannot integrate with other security products.
   • CSOAR replaces the need for security analysts entirely.
   • DSOAR is primarily a reporting tool that generates compliance reports.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is considering implementing SOAR. They currently have a manual process for handling alerts, which leads to inconsistent responses and delayed containment. The team wants to improve efficiency and consistency. Which benefit of SOAR is most relevant to this goal?

   • AAutomatic replacement of all security tools.
   • BGuaranteed prevention of data breaches.
   • CElimination of all security risks.
   • DStandardized and consistent responses through automated playbooks.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why would a SOAR platform integrate with a ticketing system?

   • ATo automatically create and update incident tickets as part of the response workflow
   • BTo provide a user interface for analysts to manually enter ticket information
   • CTo replace the ticketing system with SOAR's own case management
   • DTo store all ticket data in the SOAR database for compliance
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations center (SOC) wants to standardize its response to malware alerts. The team has defined a step-by-step process that includes isolating the affected host, collecting forensic evidence, and notifying the incident response lead. They want this process to be executed consistently every time a malware alert is confirmed. What should the SOC implement in their SOAR platform?

   • AA playbook that triggers on malware alerts and executes the defined steps automatically.
   • BA ticketing system that creates a ticket for each malware alert, but leaves the response steps to the analyst.
   • CA new SIEM rule that only generates an alert for malware, without any automated response.
   • DA dashboard that displays all malware alerts for analysts to review manually.
   Reveal Solution Discussion Select an answer first