Understand How an Organizations Technical Architectures, E.g. Network Design, Enable or Constrain Security Orchestration. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations center (SOC) is deploying a SOAR platform that will automate responses across multiple security tools. The tools are distributed across different network zones, and the SOC wants to ensure that the SOAR platform can reliably reach all of them. Which network design approach best supports this requirement?

   • AUse a VPN to connect the SOAR platform to each zone individually.
   • BCreate a dedicated management network with routes to all zones and firewall rules allowing the SOAR platform to initiate connections.
   • CPlace the SOAR platform in a DMZ with direct access to all zones.
   • DPlace the SOAR platform in the same zone as the most critical tool.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A SOAR platform needs to integrate with an on-premises ticketing system that is only reachable through a NAT gateway. Which network topology feature is most likely to restrict the SOAR platform's ability to connect to the ticketing system?

   • AThe SOAR platform's logging level
   • BThe ticketing system's disk space
   • CThe number of tickets in the queue
   • DThe NAT gateway's port forwarding rules
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a segmented network, a SOAR platform in the management zone needs to send a command to a firewall in the production zone. What network design element is most likely to constrain this orchestration action?

   • AThe number of VLANs in the production zone
   • BThe access control rules on the inter-zone firewall
   • CThe routing table on the SOAR platform
   • DThe firewall's logging configuration
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An organization wants to deploy a SOAR platform that must integrate with tools in both on-premises and cloud environments. Which architectural factor is most important to assess for compatibility?

   • AThe brand of the office coffee machine
   • BThe network connectivity between the SOAR platform and all target systems
   • CThe color scheme of the security operations center
   • DThe number of security analysts employed
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOAR platform is configured to automatically disable a user's account in Active Directory when a phishing alert is confirmed. The SOAR platform is in a different network segment than the domain controllers. The SOAR platform can reach the domain controllers, but the account disable action fails. What is the most likely cause?

   • AThe network firewall is blocking the SOAR platform's traffic to the domain controllers.
   • BThe SOAR platform is using the wrong API endpoint for Active Directory.
   • CThe domain controllers are not in the same domain as the user.
   • DThe SOAR platform does not have the necessary permissions to disable accounts.
   Reveal Solution Discussion Select an answer first