3.4 Define Automation Strategies of Agentic Versus Playbook Capabilities SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which scenario is most appropriate for playbook automation?

   • AA zero-day attack that requires the automation to develop a novel containment strategy.
   • BA situation where the automation must reason about multiple possible courses of action.
   • CAn incident where the response must change based on the attacker's real-time actions.
   • DA routine phishing alert that is handled by the same set of steps every time.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's incident response team frequently handles phishing emails that follow a consistent pattern: the email is reported, the URL is checked against a blocklist, the email is quarantined, and the user is notified. The team wants to automate this process to ensure consistency and speed. They are concerned about compliance and need a clear audit trail of every action taken. Which automation approach should they choose?

   • AImplement a playbook that executes the steps in a fixed order and logs each action.
   • BImplement an agentic automation that decides the steps based on the email content.
   • CUse an agentic automation that only recommends actions and requires human approval for each step.
   • DUse a playbook but allow the automation to skip steps if it deems them unnecessary.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a defining characteristic of agentic automation?

   • AIt requires human approval before every action it takes.
   • BIt is only used for reporting and alerting, not for taking action.
   • CIt can reason about the current situation and choose its next action accordingly.
   • DIt executes a predetermined sequence of actions without deviation.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best describes agentic automation in a security operations context?

   • AIt autonomously makes decisions and takes self-directed actions to achieve a goal, adapting to changing conditions.
   • BIt requires a human analyst to initiate every action and interpret the results before proceeding.
   • CIt follows a fixed sequence of steps that must be approved by a human at each stage.
   • DIt is limited to executing simple, single-step tasks that do not require any decision-making.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In which scenario is playbook automation more appropriate than agentic automation?

   • AWhen the incident response process is routine and follows a well-defined sequence of steps.
   • BWhen the threat landscape is constantly changing and requires real-time strategy adjustments.
   • CWhen the response must adapt to novel and unpredictable attacker behavior.
   • DWhen the organization wants to minimize human involvement in decision-making.
   Reveal Solution Discussion Select an answer first