Automate Responses Using SOAR Playbooks. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A playbook that handles high-severity alerts is experiencing timeouts when calling an external API. The API is sometimes slow. The team needs to ensure the playbook completes successfully without manual intervention. What should be configured?

   • ARemove the API call from the playbook and handle it manually.
   • BAdd retry logic with exponential backoff for the API call, and set an appropriate timeout.
   • CIncrease the playbook's overall timeout to allow more time for the API to respond.
   • DUse a loop to call the API repeatedly until it succeeds, without any delay.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of running a playbook in 'test mode'?

   • ATo measure the performance of the playbook under full production load
   • BTo permanently delete the playbook from the production environment
   • CTo execute the playbook with sample data to verify it works without affecting live systems
   • DTo convert the playbook into a different scripting language
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of integrating a SOAR playbook with an external security tool, such as a firewall or EDR?

   • ATo allow the playbook to execute actions on the tool, such as blocking an IP or isolating a host
   • BTo replace the tool's management console with the SOAR interface
   • CTo store the tool's logs within the SOAR platform
   • DTo provide a backup of the tool's configuration
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company uses a SOAR platform and wants to automatically create tickets in their ITSM tool when certain alerts occur. The ITSM tool has a REST API. What is the most efficient way to set up this integration?

   • AUse the pre-built connector for the ITSM tool in the SOAR platform and configure the action to create a ticket.
   • BUse a generic HTTP request action to call the API, but only if no connector exists.
   • CWrite a custom script to call the ITSM API and include it in the playbook.
   • DHave the playbook send an email to the ITSM team to create the ticket manually.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst receives an alert about a suspicious login. The analyst wants to automate the initial investigation, including checking the user's recent activity and determining if the login is from a known malicious IP. What is the role of a SOAR playbook in this scenario?

   • AIt can automatically execute the investigation steps, such as querying logs and threat intelligence, and present the results.
   • BIt can only provide a checklist of steps for the analyst to follow manually.
   • CIt can replace the analyst's judgment and make the final decision on whether to block the user.
   • DIt can predict future attacks based on the current alert.
   Reveal Solution Discussion Select an answer first