Develop Automation and Orchestration for Standard Operating Procedures. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In a decision tree for incident response, what does a branch typically represent?

   • AA log entry for every action taken
   • BA separate workflow for each security tool
   • CA possible outcome based on a condition evaluated at a decision point
   • DA list of all possible incident types
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a common best practice when implementing error handling in an automated workflow?

   • ARestart the entire Splunk instance
   • BStop the workflow immediately without any notification
   • CIgnore errors and continue to the next step
   • DDefine a fallback action or alert when an error cannot be resolved automatically
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A team is writing a playbook for a malware outbreak. The playbook must: isolate the affected host, collect forensic data, and then either remediate or escalate based on the presence of a specific indicator. Which playbook structure best supports this?

   • AA sequence that isolates, collects, then uses a conditional step to check for the indicator and branch to remediation or escalation.
   • BA linear sequence: isolate, collect, remediate, and then escalate if remediation fails.
   • CA structure that collects data first, then isolates, and then always remediates.
   • DA parallel structure that isolates and collects simultaneously, then always escalates regardless of the indicator.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the recommended way to store secrets used by Splunk automation?

   • AIn a secure vault or Splunk's encrypted credential store
   • BIn the automation script's comments
   • CIn an environment variable that is hardcoded in the script
   • DIn a shared spreadsheet accessible to the team
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An automation workflow for incident response must classify alerts as 'malware', 'phishing', or 'other' based on the event type field. The workflow should then route each classification to a different response playbook. What is the best way to implement this classification and routing?

   • ACreate a single playbook that handles all three types with the same steps.
   • BUse a lookup table to map event types to playbooks, but only for 'malware' and 'phishing'.
   • CUse a decision tree with multiple branches, each checking the event type field and triggering the corresponding playbook.
   • DRoute all alerts to a generic playbook that manually decides the classification.
   Reveal Solution Discussion Select an answer first