3.1 Define Strategy Based on Data Sources, Business Alignment, Organization Strategy, and Best Practice SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the most accurate definition of a detection use case in security operations?

   • AA tool or platform used to collect and analyze security logs
   • BA specific scenario or threat that security monitoring is designed to identify
   • CA set of instructions for responding to a confirmed security incident
   • DA general category of threats that the security team monitors for on a daily basis
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is an automation use case in security operations?

   • AA tool for detecting security incidents
   • BA policy for manual incident response
   • CA type of malware that automates attacks
   • DA specific process or task that can be automated to improve efficiency
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations team is evaluating which processes to automate. They have three candidates: (1) resetting passwords for locked-out users, (2) analyzing a new zero-day exploit, and (3) generating daily compliance reports. Which candidate aligns best with the business need of minimizing manual effort while maintaining human oversight?

   • AAnalyzing a new zero-day exploit, because it is high-impact.
   • BResetting passwords for locked-out users, because it is repetitive and well-defined.
   • CGenerating daily compliance reports, because it is required by regulations.
   • DAll three are equally good candidates for automation.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which statement best describes the purpose of a detection use case?

   • ATo prioritize which security tools to purchase
   • BTo automate the response to a known threat
   • CTo define a specific threat scenario that monitoring should identify
   • DTo document the steps for investigating an incident
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to automate the containment of compromised user accounts by disabling them in Active Directory and revoking their VPN access. Which data sources and integrations are required to support this automation use case?

   • AFirewall logs and an email gateway integration.
   • BDNS logs and a SIEM platform integration.
   • CEDR telemetry and a ticketing system integration.
   • DIdentity provider logs and API integrations with Active Directory and the VPN gateway.
   Reveal Solution Discussion Select an answer first