3.1 Define Strategy Based on Data Sources, Business Alignment, Organization Strategy, and Best Practice SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of an automation use case?

   • AConducting a security awareness training session
   • BManually reviewing all security alerts
   • CAutomatically quarantining a malicious file detected on an endpoint
   • DWriting a new detection rule for a SIEM
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a best practice for automation use cases?

   • AFocusing only on complex tasks that are rarely performed
   • BRemoving human oversight from all automated processes
   • CStarting with repetitive, well-understood tasks
   • DAutomating all tasks immediately without review
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A multinational organization's security strategy is driven by a threat model that prioritizes insider threats. However, the organization's largest business unit generates most of its revenue from a public-facing e-commerce platform, and its risk tolerance is focused on preventing external fraud. The security team has limited resources and must choose between two detection use cases: one for 'insider data theft via USB' and one for 'credential stuffing on the e-commerce platform.' Which use case should the team prioritize?

   • ANeither use case, and instead focus on a general 'anomalous behavior' use case.
   • BBoth use cases equally, splitting the resources between them.
   • CCredential stuffing on the e-commerce platform, because it directly protects the primary revenue source and aligns with the business unit's risk tolerance.
   • DInsider data theft via USB, because the threat model explicitly prioritizes insider threats.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the role of a security orchestration platform in automation use cases?

   • AIt only stores logs
   • BIt provides a user interface for manual analysis
   • CIt coordinates actions across multiple security tools
   • DIt replaces all security tools
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which integration is necessary to support an automation use case that automatically blocks malicious IP addresses on a firewall?

   • AIntegration between the security orchestration platform and the firewall
   • BIntegration between the HR system and the email server
   • CIntegration between the physical access system and the HVAC
   • DIntegration between the marketing platform and the CRM
   Reveal Solution Discussion Select an answer first