Develop Automation and Orchestration for Standard Operating Procedures. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which element is most important to include when designing an automated workflow that encodes an SOP?

   • AThe names of the analysts who will be on call
   • BThe cost of the hardware running Splunk
   • CThe version history of the Splunk software
   • DThe exact steps, decision points, and required inputs/outputs of the SOP
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important to log automation executions in Splunk?

   • ATo replace the need for human oversight
   • BTo provide an audit trail for compliance and troubleshooting
   • CTo automatically fix any errors that occur during execution
   • DTo reduce the amount of data stored in Splunk
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization requires that every automated response action be auditable. They need to know who triggered the automation, what actions were taken, and whether they succeeded. What should the team implement?

   • ALog only the final outcome of each automation run, without details of individual actions.
   • BEnable detailed logging for all automation executions, capturing the trigger, actions, and outcomes, and store the logs in a central location.
   • CRely on the orchestration tool's built-in audit log without additional configuration.
   • DStore logs locally on the automation server without forwarding them to a central system.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An automated workflow sends a command to a firewall to block an IP. The firewall API sometimes returns a 202 Accepted, but the block may not have been applied. The workflow must ensure the block is actually in place before proceeding. What is the best approach?

   • ATreat 202 as success and proceed immediately.
   • BRetry the block command until a 200 response is received.
   • CAssume the block is applied and log the 202 response.
   • DAfter receiving 202, poll the firewall API to verify the block is active, with a timeout and retry if not.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team has automated a complex incident response SOP. The original analyst who designed the automation has left the company. The team needs to maintain the automation, but the documentation is sparse. What is the best course of action?

   • AContinue using the automation without documentation, relying on the original analyst's knowledge.
   • BDelete the automation and recreate it when needed.
   • CRewrite the automation from scratch to ensure it is understood.
   • DHave the remaining team members review the automation code and execution logs to understand it, then update the documentation to reflect the current logic and dependencies.
   Reveal Solution Discussion Select an answer first