Develop Complex/cross Platform Automation to Orchestrate Workflows for Cybersecurity Operations Such as Investigation, Detection, and Incident Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A SOAR playbook is designed to contain a compromised user account by disabling it in Active Directory and revoking OAuth tokens in Azure AD. The playbook runs automatically when a high-confidence alert fires. However, the incident response team is concerned that if the playbook mistakenly disables a legitimate user, it could cause business disruption. They want to add a safety mechanism that allows a human to intervene before the account is disabled, but they also want to maintain the speed of automation for true emergencies. Which design best balances speed and safety?

   • AAutomatically disable the account, but have the playbook send a notification to the incident response team for post-action review.
   • BAdd a manual approval step before the account disable action, which requires an analyst to approve within 5 minutes or the action is skipped.
   • CUse a two-step process: first, automatically revoke OAuth tokens (less disruptive), then require manual approval before disabling the AD account.
   • DDisable the account only after a 15-minute delay to allow analysts to cancel if needed.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an advanced technique used to manage complex automation scenarios?

   • AAvoiding retries to prevent duplicate actions.
   • BRemoving all conditional logic to simplify the workflow.
   • CHard-coding all values to avoid configuration errors.
   • DUsing parallel execution to run independent tasks simultaneously.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of integrating automation with security tools via APIs and webhooks?

   • ATo replace the need for security tools by using automation scripts.
   • BTo enable seamless data exchange and action execution between different security platforms.
   • CTo provide a graphical user interface for security tools.
   • DTo store all security data in a single database.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team wants to automate the detection of phishing emails reported by users. When a user reports an email via the Outlook add-in, the automation should extract the email metadata, check it against threat intelligence, and if malicious, automatically delete the email from all mailboxes. The team is concerned about false positives and wants to ensure that deletion only happens when the threat intelligence verdict is 'malicious'. Which design is most appropriate?

   • ACheck threat intelligence first; if verdict is 'malicious', delete the email; otherwise, leave it and notify the user.
   • BDelete the email immediately upon user report, then check threat intelligence.
   • CAlways quarantine the email and require manual approval before deletion.
   • DDelete the email and then send a notification to the security team for review.
   Reveal Solution Discussion Select an answer first