Automate Responses Using SOAR Playbooks. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A playbook is not producing the expected output when run in production. The engineer suspects the issue is with the data format from an external API. What is the best way to debug this?

   • AAsk the API vendor to provide a sample response and manually compare it to the expected format.
   • BReview the playbook code line by line without executing it.
   • CEnable debug logging and run the playbook with a test input that simulates the API response.
   • DChange the playbook to use a different API endpoint that returns data in a different format.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC team has multiple playbooks that have evolved over time. They need to ensure that changes are tracked and that the current production version is known. What is the best practice for managing playbook versions?

   • AUse the versioning feature in the SOAR platform to save and label each change, and document the active version.
   • BHave each analyst maintain their own copy of the playbook.
   • CKeep only the latest version and delete older versions to avoid confusion.
   • DStore playbooks in a shared folder with filenames like 'playbook_final_v2'.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key consideration for making a SOAR playbook reliable in production?

   • AAvoiding the use of conditions to keep the playbook simple
   • BHandling errors gracefully, such as retrying failed actions or logging failures
   • CUsing only manual triggers to ensure human oversight
   • DStoring all data in the playbook itself to avoid external dependencies
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is versioning important for SOAR playbooks in a production environment?

   • AIt allows you to track changes and revert to a known-good version if a new version fails
   • BIt automatically fixes any errors in the playbook logic
   • CIt reduces the need for testing new playbook versions
   • DIt increases the execution speed of the playbook
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A playbook is designed to handle alerts from multiple sources. For each alert, it must enrich the indicator, and if the indicator is malicious, block it on the firewall. The playbook is running slowly because it processes alerts sequentially. What is the best way to improve performance?

   • AUse a loop to process alerts, but add a delay between each iteration to avoid overloading the firewall.
   • BIncrease the timeout for the enrichment action to allow more time.
   • CUse parallel processing for independent alerts, but ensure that the firewall blocking action is idempotent and safe to run concurrently.
   • DRemove the enrichment step and block all indicators immediately.
   Reveal Solution Discussion Select an answer first