Compare and Validate Integrations and Automation Capabilities of Enterprise Security and SOAR. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In Splunk SOAR, what is the role of an 'action' within a playbook?

   • AIt performs a specific operation on an integrated security tool
   • BIt defines the trigger conditions for the playbook
   • CIt provides a visual representation of the playbook flow
   • DIt stores the output of a search for later use
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a native integration capability of Splunk SOAR for automating incident response?

   • AA pre-built playbook that automatically quarantines an infected endpoint
   • BA data model that normalizes firewall logs
   • CAn adaptive response action that updates a ticket
   • DA correlation search that generates a notable event
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team has deployed Splunk ES and SOAR. They have a requirement that when a high-severity notable event is created in ES, SOAR should automatically run a playbook that enriches the event with threat intelligence and, if the enrichment confirms malicious activity, creates a ticket in ServiceNow. The team wants to validate that this integration works end-to-end. What is the most effective validation approach?

   • ACheck the SOAR playbook's code for correct API endpoints and authentication tokens.
   • BRun the playbook manually in SOAR on a dummy incident and verify the ticket is created.
   • CCreate a test notable event in ES, confirm SOAR receives it, and run the playbook in debug mode to verify each action and the final ticket creation.
   • DVerify that the ES correlation search is enabled and that SOAR has the correct app installed.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the first step in validating that an Enterprise Security integration is working correctly?

   • ACheck the adaptive response actions for errors
   • BCreate a playbook to test the integration
   • CConfirm that the data source is sending data to Splunk
   • DVerify that the SOAR connector is active
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of orchestration in Splunk SOAR?

   • ATo store historical incident data for compliance
   • BTo collect and normalize security data from multiple sources
   • CTo coordinate actions across multiple security tools
   • DTo provide a dashboard for monitoring security events
   Reveal Solution Discussion Select an answer first