Automate Responses Using SOAR Playbooks. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   An organization uses a SOAR platform and wants to automatically block malicious IPs on their firewall. The firewall vendor provides an API. What is the recommended way to integrate this into a playbook?

   • AUse the firewall's API connector in the SOAR platform to create an action that calls the API.
   • BHave the playbook send an email to the firewall administrator to manually block the IP.
   • CExport the IP list and import it into the firewall manually.
   • DUse a generic HTTP request action to call the API, but only if no connector exists.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A playbook is triggered by a new case in the ticketing system. The playbook needs to know the case ID and the reporter's email to send a notification. How should these values be provided to the playbook?

   • AConfigure the trigger to pass the case ID and reporter email as input parameters.
   • BHave the playbook prompt the analyst to enter the values manually.
   • CUse a generic HTTP request to fetch the case details from the ticketing system.
   • DHard-code the case ID and reporter email in the playbook.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A playbook is designed to handle account lockout alerts. It should only disable the account if the alert severity is high and the account has not been disabled in the last 24 hours. The playbook is not behaving as expected; it disables accounts even for low-severity alerts. What is the most likely cause?

   • AThe input parameters are not being passed correctly from the alert.
   • BThe account disable action is not connected to the condition's true branch.
   • CThe playbook is triggering on the wrong alert type.
   • DThe condition logic is incorrectly configured, possibly using an OR instead of an AND, or the severity field is not being compared correctly.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which playbook element is used to repeat an action for each item in a list, such as a list of affected hosts?

   • AA loop block
   • BAn input parameter
   • CA condition block
   • DAn action block
   Reveal Solution Discussion Select an answer first