Develop Complex/cross Platform Automation to Orchestrate Workflows for Cybersecurity Operations Such as Investigation, Detection, and Incident Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of workflow orchestration in cybersecurity operations?

   • ATo coordinate multiple automated tasks and processes into a cohesive incident response or detection workflow.
   • BTo store all security logs in a centralized database for manual review.
   • CTo provide a graphical interface for security analysts to manually trigger scripts.
   • DTo replace the need for security analysts by fully automating all decisions.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of detection automation?

   • AA security analyst manually reviews a dashboard of firewall logs.
   • BA vulnerability scanner runs a scan and produces a report for manual review.
   • CA SIEM rule triggers an alert when multiple failed logins occur from the same source IP within a short time.
   • DAn administrator manually updates the firewall rules to block a known malicious IP.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team has a Python-based investigation script that runs on-premises and uses hard-coded paths and credentials. They want to deploy the same script to a cloud-based SOAR platform that runs in a containerized environment. The script must work in both environments without modification. Which approach is most effective?

   • AUse a configuration file that is mounted into the container, but keep the script unchanged.
   • BCreate a separate version of the script for the cloud environment with different hard-coded values.
   • CRefactor the script to use environment variables for all configuration, including paths and credentials, and ensure it uses relative paths.
   • DWrap the script in a Docker container and run it on-premises as well.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC is implementing a SOAR platform to orchestrate incident response. The compliance team requires that all automated actions that affect systems (e.g., disabling accounts, blocking IPs) be reviewed by a human within 24 hours. The SOC wants to maintain 24/7 automated response for critical alerts. Which design best meets both requirements?

   • AAutomate all actions immediately and generate a daily report for human review.
   • BUse a hybrid approach: automate critical actions immediately, but log them for review and require manual approval for non-critical actions.
   • CAutomate only low-risk actions and require manual approval for high-risk actions.
   • DRequire manual approval for every automated action before it is executed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to automatically block an IP address on the firewall when Splunk detects a brute-force attack pattern. The detection rule is well-tuned and has a low false-positive rate. The firewall API is rate-limited to 10 requests per minute. The automation must avoid blocking legitimate traffic due to a single false positive and must handle API failures gracefully. Which design is most appropriate?

   • AAutomatically block the IP and send an email to the SOC for manual review after the block is applied.
   • BRequire the detection to fire twice within 10 minutes before triggering the block, and use a queue with retries and backoff for API calls.
   • CUse a scheduled search every hour to find all brute-force events and block all offending IPs in one API call.
   • DTrigger a firewall block immediately on every detection event, and if the API call fails, retry three times with exponential backoff.
   Reveal Solution Discussion Select an answer first