3.1 Define Strategy Based on Data Sources, Business Alignment, Organization Strategy, and Best Practice SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company wants to automate the enrichment of phishing alerts by querying a threat intelligence platform (TIP) and then creating a ticket in the ITSM system. The security team has a SOAR platform. Which integration architecture best supports this automation use case?

   • AManual copy-paste of threat intel data from the TIP into the ITSM ticket.
   • BEmail-based alerts from the TIP that analysts manually forward to the ITSM system.
   • CA direct database connection between the TIP and the ITSM system, bypassing the SOAR platform.
   • DSOAR platform with direct API integrations to both the TIP and the ITSM system.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's security operations strategy has a goal to reduce mean time to respond (MTTR) to phishing incidents. The team proposes an automation use case that automatically quarantines emails and blocks the sender across all mailboxes. Which additional step is most important to ensure this automation supports the organization's overall strategy and objectives?

   • ADocumenting the automation in the team's internal wiki.
   • BAssigning the automation to the most senior analyst for ownership.
   • CMeasuring the reduction in MTTR after implementation to validate the automation's impact.
   • DEnsuring the automation runs on a scheduled basis every hour.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which business need is most directly addressed by automating the containment of a compromised endpoint?

   • AReducing the time to respond to an incident
   • BImproving employee satisfaction
   • CIncreasing the number of security tools
   • DReducing the cost of security training
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A financial services firm has a risk tolerance that favors availability over strict security controls for its customer-facing trading platform. The security team wants to implement a detection use case that triggers on any failed login attempt followed by a successful login within 10 minutes. The business unit argues this will generate too many alerts and impact operations. Which approach best aligns the use case with the business's risk tolerance?

   • AModify the use case to trigger only when the failed logins originate from a different geographic region than the successful login.
   • BEscalate the issue to the CISO to override the business unit's concerns.
   • CCancel the use case entirely, as the business does not want any additional alerts.
   • DImplement the use case as proposed, since security detections should not be diluted by business concerns.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What data sources are typically required to support an automation use case that enriches alerts with threat intelligence?

   • AMarketing analytics and web traffic
   • BEmployee HR records and payroll data
   • CPhysical access logs and CCTV footage
   • DSIEM alerts and threat intelligence feeds
   Reveal Solution Discussion Select an answer first