Describe the Benefits of an Autonomous SOC, and Strategies, Processes, and Technologies to Develop One. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC team wants to implement self-healing workflows that automatically remediate common issues, such as reimaging a compromised endpoint, without manual intervention. However, they are concerned about the risk of automated actions causing disruption. Which process should they implement to balance automation with safety?

   • AAllow the automation to run directly in production without testing, as the steps are well-defined.
   • BRequire human approval for every remediation step, even for routine issues.
   • CUse a SOAR playbook that runs the remediation steps in a sandbox environment first, then applies them to production with a rollback plan.
   • DImplement the automation but do not log or monitor its actions, to avoid alert fatigue.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a key benefit of implementing an autonomous SOC?

   • AIt reduces the need for human analysts, so the SOC can operate with zero staff
   • BIt eliminates the need for security monitoring tools
   • CIt improves efficiency by automating repetitive tasks, allowing analysts to focus on complex threats
   • DIt guarantees that no security incident will ever be missed
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security organization is planning to transition to an autonomous SOC. They have a small team and want to minimize disruption during the transition. They also want to ensure that the team is comfortable with the new processes. Which strategy is most effective for a smooth transition?

   • AAvoid involving the team in the transition, and let the automation team handle everything.
   • BStart with a pilot program that automates a single, low-risk process, and gradually expand based on team feedback and success.
   • CAutomate only the most complex processes first, assuming they will have the most impact.
   • DImplement all automation at once to get the full benefits immediately, even if it overwhelms the team.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard · select all that apply

   A security team is building an autonomous SOC and wants to use SOAR to orchestrate response actions. They need to ensure that the automation is safe and effective. Which practices should they implement? (Select all that apply.)

   • ADefine clear approval workflows for high-impact actions, such as isolating a critical server.
   • BUse playbooks that are tested in a non-production environment before deployment.
   • CLog all automated actions and outcomes for audit and continuous improvement.
   • DAutomate all actions without any approval steps to maximize speed.
   Check answers Discussion Select an answer first
6. 30foundation · easy

   Which technology is specifically designed to orchestrate automated response actions across multiple security tools?

   • ASOAR (Security Orchestration, Automation, and Response)
   • BSIEM (Security Information and Event Management)
   • CEDR (Endpoint Detection and Response)
   • DFirewall
   Reveal Solution Discussion Select an answer first