Describe the Benefits of an Autonomous SOC, and Strategies, Processes, and Technologies to Develop One. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is proposing an autonomous SOC to their management. They need to justify the investment by highlighting the benefits. Which benefit is most compelling for a business that experiences frequent, low-severity alerts that overwhelm analysts?

   • AImmediate compliance with all regulatory requirements, as automation ensures consistent processes.
   • BImproved analyst productivity by automating alert triage, allowing them to focus on complex threats.
   • CComplete removal of the need for security staff, leading to significant cost savings.
   • DGuaranteed elimination of all security incidents, which will reduce overall risk to the business.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A mid-sized company wants to transition to an autonomous SOC but has limited security staff and a conservative risk culture. They need to maintain accountability and ensure that automation does not introduce unacceptable risks. Which strategy best supports this transition?

   • AStart with automation of low-risk, high-volume tasks like alert enrichment and ticket creation, while keeping human approval for response actions.
   • BImmediately automate all incident response actions, including containment and eradication, to maximize efficiency from day one.
   • CImplement a fully autonomous system with no human oversight, relying on AI/ML to make all decisions.
   • DFocus solely on hiring more analysts to handle the workload, avoiding automation until the team is fully staffed.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team is considering using AI/ML to enhance their autonomous SOC. They want to detect unknown threats and reduce false positives. Which technology implementation best supports this goal?

   • AUse AI/ML models trained on historical data to identify anomalies and generate alerts for human review.
   • BUse AI/ML to replace the SIEM entirely, as it can correlate data and detect threats on its own.
   • CUse AI/ML only for reporting, not for detection, to avoid complexity.
   • DUse AI/ML to automatically block all traffic that deviates from normal behavior, without human review.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations team is planning to implement an autonomous SOC. They have a mature SIEM and a well-defined incident response process, but they are concerned about the reliability of automated actions. Which strategy should they adopt to ensure continuous improvement and trust in automation?

   • AImplement a feedback loop where automated actions are reviewed regularly, and playbooks are updated based on lessons learned.
   • BAutomate only the most complex incidents, leaving routine ones for manual handling.
   • CAvoid automation altogether and rely on manual processes to ensure reliability.
   • DDeploy automation for all incident types immediately to maximize efficiency, regardless of the maturity of the process.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How do AI and machine learning contribute to an autonomous SOC?

   • ABy analyzing large volumes of data to identify anomalies and predict potential threats
   • BBy replacing the need for any security monitoring tools
   • CBy eliminating false positives entirely
   • DBy automatically generating new security policies without human review
   Reveal Solution Discussion Select an answer first