Compare and Validate Integrations and Automation Capabilities of Enterprise Security and SOAR. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company uses Splunk ES for detection and SOAR for response. They want to integrate both with a new EDR tool that provides a REST API and sends syslog alerts. The team wants to minimize the number of moving parts and avoid custom scripting. What is the best approach?

   • AUse ES to query the EDR API directly for all data and actions, bypassing SOAR.
   • BUse a forwarder to ingest the syslog alerts into ES, and use a SOAR playbook with the EDR API connector to take actions.
   • CUse SOAR to ingest syslog alerts and also query the EDR API, then send all data to ES for storage.
   • DUse SOAR to ingest the syslog alerts and use ES to query the EDR API for actions.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does Enterprise Security typically integrate with external systems compared to SOAR?

   • AEnterprise Security uses playbooks to orchestrate actions, while SOAR uses data inputs
   • BEnterprise Security uses REST APIs for actions, while SOAR uses add-ons for data
   • CBoth use the same integration methods for data and actions
   • DEnterprise Security focuses on data ingestion, while SOAR focuses on action execution
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A Splunk ES administrator needs to automate a response to a correlation search that detects multiple failed logins. The desired response is to block the source IP on the firewall and send an email to the security team. The administrator wants to use ES's native automation capabilities without involving SOAR. What is the best approach?

   • AManually create a notable event and then use a script to block the IP after review.
   • BConfigure the correlation search to generate a notable event and add an adaptive response action that runs a script to block the IP and send an email.
   • CCreate a SOAR playbook that listens for the notable event and then blocks the IP and sends an email.
   • DUse a scheduled search that runs every minute and uses a custom command to block the IP and send an email.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of a correlation search in Enterprise Security?

   • ATo provide a dashboard for security analysts
   • BTo collect data from external sources
   • CTo automatically respond to a security incident
   • DTo identify patterns of activity that may indicate a security threat
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC uses Splunk SOAR to automate response to phishing emails. They want a playbook that, when a phishing incident is created, automatically extracts indicators from the email, checks them against a threat intelligence service, and if malicious, blocks the sender's domain on the email gateway. Which SOAR feature set should they use?

   • AA correlation search in Enterprise Security that triggers an adaptive response action to block the domain.
   • BA custom script written in Python that runs on a schedule to check the email gateway logs and block domains.
   • CA playbook with actions that call the threat intelligence service and email gateway APIs, using data paths to pass extracted indicators.
   • DA SOAR action that directly queries the email gateway's database to extract indicators from emails.
   Reveal Solution Discussion Select an answer first