3.4 Define Automation Strategies of Agentic Versus Playbook Capabilities SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial institution must respond to account takeover attempts. The response process is well-documented: verify the suspicious activity, lock the account, reset credentials, and notify the customer. The institution wants to automate this process to ensure consistency and reduce response time, but it also needs a clear record of every action for regulatory compliance. Which automation approach is most suitable?

   • AUse a playbook but allow the automation to skip steps if it deems them unnecessary.
   • BUse an agentic automation that only recommends actions and requires human approval for each step.
   • CImplement an agentic automation that decides the steps based on the specific account's history.
   • DImplement a playbook that executes the documented steps in order and logs each action.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations team is considering automating the response to a new type of ransomware that mutates its encryption methods based on the environment. The team wants the automation to analyze the threat, determine the best containment strategy, and execute it without human intervention. Which automation capability is most essential for this requirement?

   • AThe ability to require human approval before each action.
   • BThe ability to execute a predefined sequence of steps in a fixed order.
   • CThe ability to log all actions for compliance purposes.
   • DThe ability to make autonomous decisions and take self-directed actions based on real-time analysis.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key feature of playbook automation?

   • AIt requires no human involvement at any point in the process.
   • BIt adapts its actions in real time based on the attacker's behavior.
   • CIt is designed to handle novel, never-before-seen threats.
   • DIt uses a fixed, ordered set of actions that are executed in a predictable manner.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which factor should an organization consider when formulating an automation strategy?

   • AThe color scheme of the security operations center.
   • BThe complexity and predictability of the incidents it typically faces.
   • CThe preference of the security team for manual processes.
   • DThe number of security vendors in the market.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary goal of an automation strategy in security operations?

   • ATo replace all human analysts with automated systems.
   • BTo ensure all incidents are handled by agentic automation.
   • CTo select the right balance of agentic and playbook automation based on organizational needs.
   • DTo minimize the cost of security operations by using only free tools.
   Reveal Solution Discussion Select an answer first