3.4 Define Automation Strategies of Agentic Versus Playbook Capabilities SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A large enterprise is developing an automation strategy for its security operations. The SOC handles a high volume of routine alerts that require consistent, auditable responses. However, the organization also faces advanced threats that require adaptive, context-aware responses, and the security team is small and often overwhelmed. The CISO wants to maximize automation while maintaining human oversight for critical decisions. Which strategy best balances these needs?

   • AImplement agentic automation for routine alerts and playbooks for advanced threats.
   • BImplement playbooks for all alerts to ensure consistency and auditability.
   • CImplement playbooks for routine alerts and agentic automation for advanced threats, with human approval gates for high-impact actions.
   • DImplement agentic automation for all alerts to maximize automation and reduce workload.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When is playbook automation the preferred choice?

   • AWhen the incident response process is well understood and follows a standard operating procedure.
   • BWhen the organization wants to minimize human oversight of the response.
   • CWhen the threat is novel and the response must be invented on the fly.
   • DWhen the automation must make independent decisions based on incomplete information.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is dealing with a sophisticated attack that uses living-off-the-land binaries and constantly changes its tactics to evade detection. The team wants to automate the response, but the appropriate actions depend on the specific binaries used, the network paths, and the current threat intelligence. Which automation approach is most appropriate?

   • ADeploy an agentic automation that analyzes the attack, correlates with threat intelligence, and selects the best response actions.
   • BUse a playbook with conditional branches based on the binaries detected.
   • CCreate a playbook that applies a fixed set of containment steps to every incident.
   • DUse an agentic automation that only escalates to a human analyst without taking any action.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which scenario is most appropriate for agentic automation?

   • AA password reset request that follows a standard approval workflow.
   • BA compliance report that must be generated in the same format every month.
   • CA routine alert that is always handled by the same fixed set of steps.
   • DA complex, adaptive threat response where the best action depends on evolving attacker behavior.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations team is developing an automation strategy. They have a high volume of routine alerts that require consistent, auditable responses, but they also face advanced threats that require adaptive, context-aware responses. The team is small and often overwhelmed, and the CISO is concerned about the risk of autonomous actions causing unintended damage. Which strategy best balances automation benefits with risk mitigation?

   • AUse agentic automation for all alerts to maximize automation and reduce workload.
   • BUse playbooks for all alerts to ensure consistency and auditability.
   • CUse agentic automation for routine alerts and playbooks for advanced threats.
   • DUse playbooks for routine alerts and agentic automation for advanced threats, with human approval gates for high-impact actions.
   Reveal Solution Discussion Select an answer first