Develop Complex/cross Platform Automation to Orchestrate Workflows for Cybersecurity Operations Such as Investigation, Detection, and Incident Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a primary benefit of using cross-platform automation to orchestrate cybersecurity workflows across diverse systems and environments?

   • AIt eliminates the need for human oversight in all security operations.
   • BIt automatically patches all vulnerabilities without requiring configuration.
   • CIt guarantees that all security tools are replaced by a single unified platform.
   • DIt ensures consistent execution of security processes regardless of the underlying platform.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of an orchestrated workflow for incident response?

   • AA script automatically isolates a compromised host and sends an email to the incident response team.
   • BA firewall rule is manually updated to block a malicious IP address.
   • CAn analyst receives an alert and manually checks the affected host's logs.
   • DA playbook automatically enriches an alert with threat intelligence, queries the affected endpoints, contains the threat, and opens a ticket for follow-up.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of an automated incident response action?

   • AAn analyst manually disconnects a compromised server from the network.
   • BA security team holds a meeting to discuss the incident response plan.
   • CAn administrator manually restores data from backups after an attack.
   • DA playbook automatically isolates an infected endpoint, kills malicious processes, and collects forensic evidence.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOAR playbook performs a series of investigation steps: querying the EDR for process execution, querying the SIEM for related logs, and then correlating the results. The EDR query sometimes takes up to 10 minutes, while the SIEM query is fast. The playbook currently runs these steps sequentially, causing the overall investigation to take too long. The team wants to reduce the total investigation time without compromising the correlation step. Which change is most effective?

   • AIncrease the timeout for the EDR query and keep sequential execution.
   • BRun the EDR and SIEM queries in parallel, then perform correlation after both complete.
   • CUse a single API call that combines both queries into one request.
   • DRun the SIEM query first, then the EDR query, and skip correlation if the SIEM returns no results.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does cross-platform compatibility mean for automation scripts?

   • AThe script can only run on a specific operating system.
   • BThe script is written in a proprietary language.
   • CThe script requires manual configuration for each environment.
   • DThe script can run on multiple operating systems and environments without modification.
   Reveal Solution Discussion Select an answer first