6.4 Explain the Functions of Security Orchestration, Automation, and Response (SOAR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which scenario best illustrates the automation function of SOAR?

   • AA SOAR playbook automatically enriches an alert with threat intelligence and opens a ticket in the ticketing system
   • BAn administrator configures a firewall rule to block a known malicious IP
   • CAn analyst manually copies an IP address from a SIEM alert and pastes it into a threat intelligence portal
   • DA security team holds a meeting to discuss the response to a major incident
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common use case for SOAR?

   • AManaging user passwords and access controls
   • BAutomated alert triage to prioritize and investigate security alerts
   • CReplacing the firewall to block all incoming traffic
   • DPerforming regular backups of critical servers
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of security orchestration, automation, and response (SOAR) in security operations?

   • ATo replace the need for human security analysts by fully automating all security decisions
   • BTo provide a centralized platform that integrates security tools and automates response processes to improve efficiency and consistency
   • CTo store and index large volumes of log data for long-term compliance and forensic analysis
   • DTo act as a next-generation firewall that filters network traffic and blocks malicious packets
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC receives a large number of alerts daily. Analysts spend most of their time investigating low-priority alerts, which delays response to critical incidents. The SOC wants to use SOAR to automatically prioritize alerts based on severity and asset criticality, and only escalate high-priority alerts to analysts. Which SOAR use case does this describe?

   • AThreat hunting
   • BVulnerability management
   • CIncident investigation
   • DAlert triage
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a core component of a SOAR platform?

   • AA ticketing system for tracking incidents
   • BA playbook engine for defining and executing automated workflows
   • CA vulnerability scanner for identifying system weaknesses
   • DA network intrusion detection system (IDS) sensor
   Reveal Solution Discussion Select an answer first