Automate Responses Using SOAR Playbooks. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common way to trigger a SOAR playbook?

   • AManually by an analyst from the incident details page
   • BBy editing the playbook's source code in a text editor
   • CBy sending an email to the security team's distribution list
   • DBy restarting the SOAR platform's web server
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A playbook that runs on every alert is causing performance issues in the SOAR platform. The playbook performs several actions, including enrichment and notification. The team wants to reduce the load on the platform while still responding to all alerts. What is the best approach?

   • AUse conditions to filter alerts and only run the full playbook for high-priority alerts, while using a simpler playbook for low-priority alerts.
   • BRun the playbook on a schedule instead of on every alert.
   • CIncrease the number of concurrent playbook executions allowed.
   • DRemove the notification action from the playbook to reduce the number of actions.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company uses a third-party ticketing system and a cloud-based threat intelligence platform. The SOAR playbook must automatically create a ticket and enrich indicators using these external services. What is the first step the engineer should take to enable these integrations?

   • AConfigure the appropriate app or connector for each external service in the SOAR platform and provide the necessary credentials.
   • BWrite custom Python scripts that directly call the external APIs from within the playbook.
   • CCreate a new playbook that uses generic HTTP requests to call the external APIs without any configuration.
   • DSet up a VPN between the SOAR platform and the external services to ensure connectivity.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A playbook that processes alerts from multiple sources is taking too long to complete, causing delays in response. The playbook currently performs several sequential actions, including enrichment, deduplication, and notification. The team needs to reduce execution time without changing the outcome. Which optimization should be applied?

   • ACombine all actions into a single large action that does everything at once.
   • BIncrease the timeout for each action to allow more time for completion.
   • CRun independent actions in parallel where possible, and use conditions to skip unnecessary steps.
   • DRemove all error handling and retries to speed up the playbook.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to automate the initial response to malware alerts. They want the playbook to automatically isolate the affected host and notify the incident response team. What is the primary benefit of using a SOAR playbook for this task?

   • AIt replaces the need for other security tools like EDR and firewalls.
   • BIt eliminates the need for any human oversight in the incident response process.
   • CIt reduces manual effort and response time by executing predefined actions consistently.
   • DIt guarantees that the malware is completely removed from the host.
   Reveal Solution Discussion Select an answer first