Compare and Validate Integrations and Automation Capabilities of Enterprise Security and SOAR. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–23

1. 21foundation · easy

   What type of automation is primarily used by Enterprise Security to generate alerts?

   • AEvent-driven automation based on correlation searches
   • BWorkflow-driven orchestration
   • CManual playbook execution
   • DMachine learning-based predictive automation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team uses Splunk SOAR to automate incident response. They have a playbook that, on a new phishing incident, enriches the incident with threat intelligence and then creates a ticket in ServiceNow. The team wants to verify that the playbook is working correctly in production without affecting real incidents. What should they do?

   • ADisable the playbook and manually perform the steps in the SOAR UI to see if they work.
   • BReview the playbook's source code and compare it to the documentation.
   • CRun the playbook in debug mode on a test incident and review the action results and data paths.
   • DCreate a new playbook that only logs the actions and never actually calls the ServiceNow API.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A Splunk Enterprise Security administrator wants to automatically generate a notable event when a user fails authentication more than five times in ten minutes. They also want to run a script to disable the user's account when this occurs. What should they configure in ES?

   • AA data model acceleration that triggers a script when the authentication data model is updated.
   • BA saved search that runs every ten minutes and sends an email alert to the security team.
   • CA correlation search that creates a notable event and an adaptive response action that runs the script.
   • DA SOAR playbook that monitors authentication logs and runs the script via an action.
   Reveal Solution Discussion Select an answer first