Develop Complex/cross Platform Automation to Orchestrate Workflows for Cybersecurity Operations Such as Investigation, Detection, and Incident Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is audit logging important in security automation?

   • AIt helps to speed up the automation execution.
   • BIt provides a record of actions taken by automation for compliance and forensic analysis.
   • CIt automatically prevents all security incidents.
   • DIt eliminates the need for access controls.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an active ransomware incident, a SOC analyst uses a SOAR playbook to contain the affected endpoints. The playbook must isolate the endpoints from the network, kill the malicious process, and collect forensic evidence. The analyst needs to confirm each step before the next one proceeds, because a failed containment could spread the ransomware. Which playbook design best meets this requirement?

   • ARun isolation and process kill in parallel, then collect evidence after both complete.
   • BUse a linear sequence with manual approval gates between each action.
   • CRun all actions in parallel to minimize time to containment.
   • DUse a single action that performs all three steps via a custom script.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the main goal of automating security investigation tasks?

   • ATo speed up data collection, correlation, and analysis so analysts can focus on higher-level decision making.
   • BTo eliminate the need for security analysts to review any data.
   • CTo automatically block all suspicious IP addresses without human review.
   • DTo store all investigation data in a single spreadsheet for manual review.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) uses Splunk Enterprise Security, a third-party EDR platform, and a ticketing system. Analysts currently pivot manually between these tools during an investigation, which delays containment. You are asked to design an orchestrated workflow that, when a high-severity alert fires in Splunk, automatically enriches the alert with EDR telemetry, creates a ticket, and notifies the on-call analyst via chat. The workflow must be maintainable by the SOC team, which has limited coding experience. Which approach best meets the requirement?

   • ACreate a series of saved searches in Splunk that export alert data to a shared folder, which the EDR and ticketing systems import periodically.
   • BUse Splunk's alert action to send an email to the on-call analyst and manually copy the alert details into the ticketing system.
   • CConfigure a Splunk alert to trigger a webhook that invokes a SOAR platform playbook, which uses built-in connectors to enrich, ticket, and notify.
   • DBuild a custom Python script that polls Splunk for new alerts, calls the EDR API, creates tickets, and sends chat messages, then schedule it with cron.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a best practice for ensuring portability of automation scripts across different platforms?

   • AUsing environment variables and configuration files to handle platform-specific settings.
   • BUsing absolute file paths that are specific to one operating system.
   • CWriting separate scripts for each platform to ensure compatibility.
   • DHard-coding the platform type in the script to avoid errors.
   Reveal Solution Discussion Select an answer first