Develop Automation and Orchestration for Standard Operating Procedures. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team has automated several incident response SOPs. Over time, the team's procedures have changed, but the automation has not been updated. What is the best way to keep the automated SOPs current and effective?

   • AUpdate the automation only when an incident reveals a problem.
   • BFreeze the automation to ensure stability and avoid introducing errors.
   • CEstablish a periodic review process where the automation is compared against the current SOP and updated as needed.
   • DRely on the original documentation without checking if it matches the current automation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary role of an orchestration tool when integrated with Splunk?

   • ATo trigger and manage automated response actions based on Splunk alerts
   • BTo store all raw event data that Splunk ingests
   • CTo replace Splunk's search and reporting capabilities
   • DTo provide a graphical interface for writing Splunk queries
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which Splunk feature is commonly used to send alert data to an external orchestration tool?

   • ASplunk Machine Learning Toolkit
   • BWebhook alert action
   • CSplunk Data Model
   • DSplunk DB Connect
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations team wants to automate their phishing response SOP. The SOP says: if an email is reported, check the URL reputation; if the reputation is malicious, block the URL and quarantine the mailbox; if benign, close the ticket. The team wants to implement this in a single automated workflow. Which design best encodes this SOP?

   • AA linear workflow that always runs the URL check, then always blocks and quarantines, then closes the ticket.
   • BA workflow that only blocks the URL and quarantines the mailbox, skipping the URL reputation check entirely.
   • CA workflow that closes the ticket first, then performs the URL check and containment actions asynchronously.
   • DA workflow with a decision node after the URL check that branches to blocking/quarantining only if malicious, otherwise closes the ticket.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is it important to document automated SOPs?

   • ATo eliminate the need for testing
   • BTo ensure other team members can understand, maintain, and update the automation
   • CTo make the automation run faster
   • DTo automatically generate new SOPs
   Reveal Solution Discussion Select an answer first