6.4 Explain the Functions of Security Orchestration, Automation, and Response (SOAR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company uses a SOAR platform to automate incident response. They want to automatically block a malicious IP address on their firewall when a certain type of alert is confirmed. Which integration is necessary for this automation to work?

   • AIntegration with the firewall's API to push block rules.
   • BIntegration with the ticketing system to create a ticket.
   • CIntegration with the threat intelligence platform to enrich the alert.
   • DIntegration with the SIEM to receive the alert.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which capability is a defining feature of a SOAR platform's response function?

   • APerforming vulnerability scans on a scheduled basis
   • BCollecting and analyzing raw network packets in real time
   • CAutomatically blocking a malicious IP address on a firewall
   • DEncrypting all data at rest in the organization's databases
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the main benefit of automation in a SOAR platform?

   • AIt stores all incident data in a centralized database for later analysis
   • BIt reduces manual effort by executing predefined workflows automatically
   • CIt eliminates the need for security analysts to review any alerts
   • DIt provides a graphical interface for analysts to manually run scripts
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC wants to ensure that all analysts follow the same procedure when responding to a specific type of alert. The procedure involves multiple steps, some of which require approval from a senior analyst. The team wants to enforce this procedure consistently. What should they create in their SOAR platform?

   • AA dashboard that shows the alert queue for all analysts.
   • BA ticketing system that creates a ticket for each alert.
   • CA SIEM rule that generates the alert but does not guide the response.
   • DA playbook that includes approval steps for certain actions.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small security team handles hundreds of phishing emails per week. Currently, an analyst manually checks each email's headers, queries the threat intelligence platform for the sender's reputation, and then quarantines the email if it is malicious. The team wants to reduce the time spent on this repetitive task while still allowing an analyst to review suspicious cases. What is the most effective SOAR approach?

   • ACreate a playbook that automatically checks headers and reputation, and only escalates emails that meet certain malicious criteria to an analyst for quarantine.
   • BAutomate the entire phishing triage workflow, including quarantine, without any human review.
   • CUse a SIEM to correlate phishing emails with other alerts, but continue manual quarantine procedures.
   • DImplement a ticketing system to track phishing emails, but keep all analysis manual.
   Reveal Solution Discussion Select an answer first