Develop Complex/cross Platform Automation to Orchestrate Workflows for Cybersecurity Operations Such as Investigation, Detection, and Incident Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a secure coding practice for automation scripts?

   • ADisabling logging to reduce storage usage.
   • BHard-coding credentials in the script for simplicity.
   • CGranting all users full access to the automation system.
   • DUsing input validation to prevent injection attacks.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company uses Splunk SOAR to orchestrate incident response. The playbook needs to automatically create a ticket in ServiceNow, block an IP on the firewall, and send a Slack notification. The team wants to minimize custom code and use built-in capabilities. Which integration approach is most aligned?

   • AUse email-based integration where the playbook sends emails to each system's email-to-ticket gateway.
   • BWrite custom Python scripts to call each API directly.
   • CUse webhooks from each system to trigger separate playbooks.
   • DUse the built-in connectors for ServiceNow, firewall, and Slack within the playbook.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is error handling important in complex automation scenarios?

   • AIt ensures that the automation never fails.
   • BIt eliminates the need for testing automation scripts.
   • CIt automatically fixes all bugs in the automation code.
   • DIt allows the workflow to continue or fail gracefully when unexpected conditions occur.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A global company has SOC teams in different regions using different SIEM platforms (Splunk, QRadar, and Microsoft Sentinel). They want to standardize incident response workflows so that the same playbook logic runs regardless of the SIEM that generated the alert. Which approach best achieves cross-platform orchestration?

   • ADevelop a SOAR playbook that uses a common data model and connectors for each SIEM.
   • BCreate separate playbooks for each SIEM and maintain them independently.
   • CStandardize on one SIEM platform to simplify automation.
   • DUse a single Python script that parses each SIEM's alert format and runs the same actions.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team develops a Python-based investigation script that uses absolute file paths like /opt/security/scripts and hard-coded API endpoints. The script works on a Linux server but fails when deployed to a Windows-based SOAR platform. The team needs to make the script portable across both environments. Which change is most effective?

   • AWrap the script in a Docker container to abstract the OS differences.
   • BCreate a separate script for each OS and maintain them in parallel.
   • CReplace absolute paths with relative paths and use environment variables for API endpoints.
   • DUse a Windows-specific path format and update the endpoints to the Windows environment.
   Reveal Solution Discussion Select an answer first