Automate Responses Using SOAR Playbooks. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which component is typically required to connect a SOAR playbook to an external service?

   • AA custom scripting language unique to each vendor
   • BA VPN tunnel to the external service's headquarters
   • CA connector or integration that handles authentication and API calls
   • DA dedicated physical server for each external service
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A playbook is triggered by a new alert and needs to access the alert's severity and affected host. These values are used in subsequent actions. How should the playbook obtain these values?

   • AUse the alert's input parameters, which are automatically passed to the playbook when it is triggered.
   • BQuery the external ticketing system to retrieve the values.
   • CHard-code the severity and host values in the playbook for consistency.
   • DPrompt the analyst to manually enter the values each time the playbook runs.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a best practice for managing playbook versions in a production environment?

   • AEdit playbooks directly in production to save time
   • BKeep only the latest version and delete older versions to save storage
   • CPromote playbooks from a development environment to production only after testing and approval
   • DUse the same version for all environments to avoid configuration drift
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best describes how a SOAR playbook relates to an incident response workflow?

   • AIt is a set of automated steps that execute response actions in a defined order
   • BIt is a manual checklist that analysts follow step by step
   • CIt is a log of past incidents used to train new analysts
   • DIt is a static document that defines roles and responsibilities
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which approach can improve the performance of a SOAR playbook that processes a large number of indicators?

   • AAdding more condition blocks to the playbook
   • BUsing parallel processing to handle multiple indicators concurrently
   • CIncreasing the playbook's timeout setting
   • DProcessing indicators one by one in a loop without any parallelization
   Reveal Solution Discussion Select an answer first