Develop Automation and Orchestration for Standard Operating Procedures. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization's automated incident response workflows are failing intermittently. The team needs to identify the root cause. What is the most effective way to diagnose the issue?

   • ADisable the automation until the issue is resolved.
   • BRestart the automation service and hope the issue resolves.
   • CCheck only the final outcome of the workflows to see which ones failed.
   • DReview the detailed execution logs of the failed workflows, including error messages and timestamps, and correlate them with external system status.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Splunk environment must trigger a third-party SOAR platform to run a playbook whenever a high-severity correlation search fires. The SOAR platform exposes a REST API that accepts an authentication token. Which integration approach should the Splunk admin use?

   • AUse email alert action to send the alert details to the SOAR platform's inbox.
   • BSchedule a saved search to export the alert data to a CSV file that the SOAR platform polls every minute.
   • CConfigure a webhook output in Splunk that sends an HTTP POST to the SOAR API with the token in the header.
   • DHave the SOAR platform connect directly to the Splunk database to read the alert table.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A team has built a playbook that automatically blocks IP addresses. Before production deployment, they want to test it thoroughly. The playbook uses a live firewall API. What is the best testing approach?

   • ATest only the happy path in a development environment, ignoring error scenarios.
   • BUse a sandbox firewall or a mock API that simulates the firewall's responses, and test the playbook's logic and error handling.
   • CDeploy to production and monitor the first few executions.
   • DRun the playbook against the production firewall with a test IP address.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC is automating a containment SOP. The SOP requires that if a host is confirmed infected, it must be isolated immediately, but if the host is a domain controller, isolation must be delayed until a senior analyst approves. The automation must also handle the case where the host's role is unknown. Which workflow design best satisfies these requirements?

   • AA workflow that always waits for analyst approval before isolating any host.
   • BA linear workflow that isolates every infected host immediately, regardless of role.
   • CA single decision tree that checks infection status, then checks if the host is a domain controller, and if so, waits for approval; otherwise isolates immediately; if role is unknown, escalates to an analyst.
   • DA workflow that isolates the host immediately and then checks the role afterwards.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important to include retry mechanisms in automated workflows?

   • ATo log errors without taking any corrective action
   • BTo handle transient failures, such as network timeouts, by reattempting the action
   • CTo automatically change the workflow's logic if it fails
   • DTo ensure the workflow runs faster by skipping steps
   Reveal Solution Discussion Select an answer first