Describe the Benefits of an Autonomous SOC, and Strategies, Processes, and Technologies to Develop One. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A large enterprise is transitioning to an autonomous SOC. They have a mature SIEM, but their incident response process is still heavily manual. They want to automate as much as possible, but they have a strict compliance requirement that all containment actions on critical systems require human approval. Which strategy best balances automation with this constraint?

   • AKeep all response actions manual, but automate alert triage to reduce analyst workload.
   • BAutomate triage and enrichment for all alerts, and automate containment for non-critical systems, while requiring human approval for critical systems.
   • CAutomate containment for all systems, but require human approval only for systems that have been compromised in the past.
   • DAutomate all response actions, including containment on critical systems, and rely on post-incident review to satisfy compliance.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a core operational goal of an autonomous SOC?

   • ATo reduce the time between threat detection and response by automating routine workflows
   • BTo eliminate the need for security analysts entirely
   • CTo replace all security tools with a single automation platform
   • DTo ensure that every alert is manually reviewed by a senior analyst
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is human oversight still necessary in an autonomous SOC?

   • ATo replace the need for automation in the SOC
   • BTo manually approve every automated action taken by the SOC
   • CTo monitor the SOC's network bandwidth usage
   • DTo handle complex incidents that require judgment and to ensure accountability for automated decisions
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   An organization is implementing an autonomous SOC and wants to ensure that human oversight is maintained. Which practices are essential for effective human oversight? (Select all that apply.)

   • AAutomate all decisions, including those with high impact, to reduce the need for human intervention.
   • BEstablish a governance board that reviews and approves automation policies and playbooks.
   • CProvide analysts with the ability to override automated decisions when they believe an action is incorrect.
   • DConduct regular audits of automated actions to ensure they are performing as expected.
   Check answers Discussion Select an answer first
6. 5foundation · easy

   How does an autonomous SOC contribute to enhanced threat detection?

   • ABy replacing all security tools with a single AI system
   • BBy automatically correlating data from multiple sources to identify potential threats faster
   • CBy requiring analysts to manually review every log entry
   • DBy disabling all alerts that are not critical
   Reveal Solution Discussion Select an answer first