Develop Automation and Orchestration for Standard Operating Procedures. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Splunk admin is integrating Splunk with a ticketing system via its REST API. The API has a rate limit of 10 requests per minute. The admin expects a burst of alerts that could exceed this limit. What should the admin do to ensure all alerts are processed without hitting the rate limit?

   • AImplement a queue in the automation that holds alerts and sends them at a controlled rate, with retry on rate-limit errors.
   • BSend all alerts immediately and hope the API can handle the burst.
   • CIncrease the rate limit by requesting a higher tier from the ticketing system.
   • DIgnore the rate limit and send alerts as fast as possible.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An automated workflow calls an external API to block an IP address. The API occasionally returns a 503 (service unavailable) error. The workflow should retry the call, but only a limited number of times, and then alert an analyst if it still fails. What is the best error-handling approach?

   • AIgnore the 503 error and continue with the next step in the workflow.
   • BImmediately fail the workflow and send an alert on the first 503 error.
   • CImplement a retry loop that retries the API call up to 3 times with a delay, and if all retries fail, send an alert to the analyst.
   • DRetry the API call indefinitely until it succeeds, without any alerting.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a step that would be included in a playbook for a phishing email incident?

   • ADisabling the email server
   • BQuarantining the malicious email and notifying the security team
   • CAutomatically deleting the user's entire mailbox
   • DSending a mass email to all employees about the incident
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Splunk admin is setting up an automation that uses a service account with elevated privileges to perform actions. The admin is concerned about the risk of credential misuse. What is the best practice to minimize this risk?

   • AUse a shared admin account for all automation to simplify management.
   • BStore the credentials in the automation script for easy access.
   • CGrant the service account full admin rights to ensure it can perform any action.
   • DUse a dedicated service account with the minimum necessary permissions, store credentials in a secrets manager, and enable audit logging for its usage.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A Splunk environment must trigger a SOAR playbook when a specific alert fires. The SOAR API requires mutual TLS (mTLS) for authentication. The Splunk admin has the client certificate and key. Which configuration is correct?

   • AUse a username and password in the webhook URL for authentication.
   • BConfigure the webhook alert action to use the client certificate and key for the HTTPS request.
   • CDisable TLS verification to allow the connection without a client certificate.
   • DUse a simple API key in the header instead of mTLS, as it is easier.
   Reveal Solution Discussion Select an answer first