Describe the Benefits of an Autonomous SOC, and Strategies, Processes, and Technologies to Develop One. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations team is overwhelmed by a high volume of low-severity alerts, causing delays in responding to genuine threats. They want to reduce alert fatigue while ensuring that critical incidents are escalated to human analysts. Which approach best aligns with the benefits of an autonomous SOC?

   • AIncrease the number of human analysts to manually review every alert, ensuring no potential threat is missed.
   • BImplement SOAR playbooks that automatically triage and enrich alerts, then escalate only those that meet predefined criticality criteria.
   • CDeploy an AI/ML model that automatically blocks all suspicious activity without human review.
   • DDisable all low-severity alert rules to eliminate noise and allow analysts to focus only on high-severity alerts.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which strategy is most aligned with an automation-first approach for transitioning to an autonomous SOC?

   • AReplace all manual processes with automation in a single deployment
   • BAutomate only the most complex incident response procedures first
   • CAutomate simple, repetitive tasks first, then gradually expand to more complex workflows
   • DFocus only on automating detection, leaving all response actions manual
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What does automated alert triage in an autonomous SOC typically involve?

   • ADeleting all alerts that are not marked as critical
   • BManually reviewing each alert to determine if it is a true positive
   • CUsing rules and analytics to prioritize alerts and filter out false positives automatically
   • DEscalating every alert to a senior analyst for review
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is implementing an autonomous SOC and wants to ensure that automated actions do not violate compliance requirements or cause unintended damage. They also need to handle complex incidents that require human judgment. Which practice is essential for maintaining human oversight?

   • AAllow the SOAR platform to make all decisions, including those with high impact, to maximize efficiency.
   • BRely on the security team to review all automated actions after they occur, without predefining approval steps.
   • CDisable all automated response actions and require manual approval for every step, even low-risk ones.
   • DEstablish a governance framework that defines which actions can be automated and requires human approval for high-impact or irreversible actions.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC analyst notices that a common malware infection consistently requires the same containment steps: isolate the host, block the IP, and notify the system owner. The team wants to automate this process to reduce response time. Which process best exemplifies an autonomous SOC workflow?

   • ACreate a SOAR playbook that executes the containment steps automatically and sends a notification to the analyst for post-action review.
   • BRely on the analyst's memory to perform the steps without documentation or automation.
   • CDocument the steps in a runbook and have analysts manually execute them each time to ensure accuracy.
   • DUse a script that runs the steps but requires the analyst to manually trigger it each time.
   Reveal Solution Discussion Select an answer first