Compare and Validate Integrations and Automation Capabilities of Enterprise Security and SOAR. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC wants to automatically block an IP address when a specific correlation search in Enterprise Security triggers. They also want to send an email notification to the analyst on duty. Which approach best fits ES's automation model?

   • AUse a scheduled search that runs every minute and uses a custom command to block the IP.
   • BCreate a SOAR playbook that monitors the ES notable events and then blocks the IP and sends an email.
   • CConfigure an adaptive response action on the correlation search to run a script that blocks the IP and sends an email.
   • DManually create a notable event and then use a script to block the IP after review.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following describes a native data input method that Enterprise Security uses to ingest security data from external sources?

   • AUsing the Enterprise Security REST API to push data to an external SIEM
   • BUsing the Adaptive Response framework to collect data from a firewall
   • CUsing the SOAR playbook editor to pull data from a ticketing system
   • DUsing the Splunk Add-on for Windows to collect Windows event logs
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of the Splunk Add-on for a specific technology (e.g., Palo Alto Networks) in the context of Enterprise Security?

   • ATo automate the response to security incidents
   • BTo provide a graphical interface for managing that technology
   • CTo collect and normalize data from that technology into Splunk
   • DTo replace the need for a separate SIEM platform
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC uses Splunk SOAR to automate incident response. They have a playbook that, when a new incident is created, automatically queries Active Directory to disable a user account if the incident is confirmed as compromised. The team wants to ensure that the playbook only runs when the incident severity is 'high'. What should they configure?

   • ACreate a separate playbook for each severity level and manually assign them.
   • BAdd a decision block in the playbook that checks the incident severity and only proceeds if it is 'high'.
   • CUse a filter in the SOAR ingestion process to only create incidents with severity 'high'.
   • DConfigure the playbook to run on every incident and rely on the analyst to manually skip low-severity incidents.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team uses Splunk Enterprise Security (ES) to monitor a hybrid environment. They need to ingest firewall logs from a vendor that provides logs via Syslog, and they also want to collect cloud audit logs from AWS CloudTrail. The team wants a single, consistent method to bring both data sources into ES. Which approach should they use?

   • AConfigure a heavy forwarder to send Syslog data to the indexer, and use the AWS Add-on for Splunk to collect CloudTrail logs.
   • BUse a universal forwarder to collect Syslog from the firewall and configure the CloudTrail bucket as a data input in ES.
   • CUse the SOAR platform's built-in Syslog connector and AWS CloudTrail connector to ingest both data sources directly into ES.
   • DConfigure ES's native REST API to pull logs from both the firewall and AWS CloudTrail on a schedule.
   Reveal Solution Discussion Select an answer first