Describe the Benefits of an Autonomous SOC, and Strategies, Processes, and Technologies to Develop One. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a key governance responsibility of human analysts in an autonomous SOC?

   • ATo ensure that the SOC operates without any human intervention
   • BTo ensure that automated workflows comply with organizational policies and regulatory requirements
   • CTo write all detection rules manually without any automation support
   • DTo disable automation whenever a false positive is detected
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An organization's autonomous SOC has been running for several months. The team notices that automated playbooks are occasionally making incorrect decisions, such as blocking legitimate IP addresses. They want to improve the system's accuracy while maintaining efficiency. Which approach should they take?

   • ADisable all automated actions and revert to manual processes to avoid incorrect decisions.
   • BImplement a human-in-the-loop review process for automated actions that have a high potential for impact, and use feedback to refine the playbooks.
   • CIncrease the automation level for all actions, assuming that more automation will reduce errors.
   • DRely on the AI/ML system to self-correct without human intervention, as it learns from its mistakes.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC team is implementing an autonomous SOC and wants to automate the response to a common phishing incident. The playbook includes isolating the affected user's machine, resetting their password, and notifying HR. However, the team is concerned about the risk of isolating a machine that is also used for critical business operations. Which process should they implement to mitigate this risk?

   • ASkip the isolation step and only automate the password reset and HR notification.
   • BInclude a pre-check in the playbook that verifies the machine is not part of a critical business function before isolating it.
   • CAutomate the isolation step but require human approval for the password reset and HR notification.
   • DAutomate the entire playbook without any checks, as the steps are well-defined.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is evaluating the benefits of moving to an autonomous SOC. They want to demonstrate to management how this will improve their security posture. Which benefit is most directly achieved by automating alert triage and response?

   • AElimination of all false positives from the alerting system.
   • BGuaranteed prevention of all security breaches.
   • CComplete removal of the need for human security analysts.
   • DReduced mean time to respond (MTTR) to security incidents.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard · select all that apply

   A security team is defining the operational goals of their autonomous SOC. They want to ensure that the SOC is efficient, effective, and accountable. Which goals should they include? (Select all that apply.)

   • AReduce the mean time to detect and respond to incidents through automation.
   • BContinuously improve automation based on feedback and lessons learned.
   • CEliminate all manual processes to achieve full automation.
   • DMaintain human oversight for complex incidents and governance.
   Check answers Discussion Select an answer first