Develop Complex/cross Platform Automation to Orchestrate Workflows for Cybersecurity Operations Such as Investigation, Detection, and Incident Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary function of automated detection mechanisms in cybersecurity?

   • ATo manually review all security events.
   • BTo replace the need for security monitoring tools.
   • CTo trigger alerts and initiate response actions based on predefined rules and threat intelligence.
   • DTo automatically patch vulnerabilities in software.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company uses Splunk to detect a specific malware signature. The detection rule is known to produce occasional false positives. When the rule fires, a SOAR playbook automatically quarantines the affected endpoint. The security team is concerned that false positives are causing unnecessary quarantines, which disrupt users. They want to reduce false-positive quarantines without completely disabling automation. Which approach is most effective?

   • AAdd a confirmation step in the playbook that checks for additional indicators (e.g., network connections to a known C2) before quarantining.
   • BChange the playbook to only send an email notification instead of quarantining.
   • CIncrease the sensitivity of the detection rule to catch more true positives.
   • DDisable the detection rule and rely on manual analysis.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An automated detection workflow in Splunk triggers a SOAR playbook that queries an external threat intelligence API. The API occasionally returns a 429 (rate limit) or 503 (service unavailable) error. The playbook must continue processing other alerts while waiting for the API to recover, and it must not lose the alert data. Which error-handling strategy is most appropriate?

   • ARetry the API call immediately up to 10 times with no delay.
   • BAbort the playbook and drop the alert if the API call fails.
   • CUse a retry with exponential backoff and a maximum retry count; if it still fails, place the alert in a dead-letter queue for manual review.
   • DUse a fixed 5-second delay between retries, but only retry once.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is building a SOAR playbook that automatically disables user accounts and resets passwords in response to a confirmed insider threat. The compliance team requires that all actions be logged with the identity of the analyst who triggered the playbook, and that the playbook cannot be modified by unauthorized users. The team also wants to ensure that if the playbook fails mid-execution, the logs are still preserved. Which combination of controls is most appropriate?

   • AEnable audit logging on the SOAR platform, use role-based access control (RBAC) to restrict playbook modification, and store logs in a separate, immutable storage location.
   • BRequire multi-factor authentication for all analysts and use a separate logging system for playbook executions.
   • CUse a shared service account for all playbook executions and rely on the SOAR platform's default logging.
   • DEncrypt the playbook definition and store it in a version control system.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOAR platform is used to automate incident response actions, including disabling user accounts and blocking IPs. The compliance team requires that every automated action be traceable to the analyst who initiated it and that the action cannot be modified after execution. Which configuration is essential to meet this requirement?

   • ARequire multi-factor authentication for all analysts accessing the SOAR platform.
   • BEnable detailed audit logging that records the actor, action, timestamp, and outcome for every playbook execution.
   • CStore playbook definitions in a version control system with branch protection.
   • DUse a shared service account for all playbook executions to simplify credential management.
   Reveal Solution Discussion Select an answer first