Describe the Benefits of an Autonomous SOC, and Strategies, Processes, and Technologies to Develop One. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is continuous improvement an important strategy for an autonomous SOC?

   • ABecause automation is a one-time project that requires no further updates
   • BBecause the SOC should eventually become fully automated with no human involvement
   • CBecause automated workflows must be regularly reviewed and refined to remain effective against evolving threats
   • DBecause the SOC must constantly change its tools to avoid vendor lock-in
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to improve threat detection by correlating data from multiple sources and identifying patterns that indicate a coordinated attack. They also want to automate initial response actions. Which combination of technologies is most aligned with an autonomous SOC?

   • ASIEM and SOAR, but without AI/ML, relying on rule-based detection only.
   • BAI/ML alone, which can automatically detect and respond to all threats without additional tools.
   • CSIEM for centralized log management, SOAR for orchestrated response, and AI/ML for anomaly detection.
   • DSOAR alone, using its built-in analytics to correlate data and automate responses.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a self-healing workflow in the context of an autonomous SOC?

   • AA workflow that automatically reverts changes made by an attacker and restores affected systems to a known-good state
   • BA workflow that requires an analyst to manually approve every remediation step
   • CA workflow that only generates a report of the incident for later review
   • DA workflow that deletes all logs related to the incident to prevent further damage
   Reveal Solution Discussion Select an answer first
5. 24expert · hard · select all that apply

   A security team is designing an autonomous SOC and wants to implement automated alert triage. They want to reduce the number of alerts that require human review. Which processes should they implement? (Select all that apply.)

   • AUse SOAR playbooks to automatically enrich alerts with threat intelligence and context.
   • BRequire human review of every alert, regardless of its score or enrichment, to ensure accuracy.
   • CAutomatically close all alerts that do not match a known threat pattern.
   • DImplement AI/ML models to score alerts based on severity and likelihood of being a true positive.
   Check answers Discussion Select an answer first
6. 25expert · hard

   A security team is evaluating technologies for their autonomous SOC. They have a limited budget and need to choose between investing in a SOAR platform or an AI/ML-based detection system. They want to improve both detection and response capabilities. Which approach is most cost-effective and aligned with an autonomous SOC?

   • AInvest in an AI/ML-based detection system that can also automate response actions, eliminating the need for SOAR.
   • BInvest in additional SIEM storage to improve detection, and continue manual response processes.
   • CInvest in both SOAR and AI/ML, even though it exceeds the budget, to get the best of both worlds.
   • DInvest in a SOAR platform that integrates with their existing SIEM to automate response, and use the SIEM's built-in analytics for detection.
   Reveal Solution Discussion Select an answer first