Optimize Case Management. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC manager needs to provide a monthly report to leadership showing the average time to close cases, the number of cases handled per analyst, and the percentage of cases that were reopened. The data is in Splunk SOAR. What is the most efficient way to produce this report?

   • AUse a third-party reporting tool that requires exporting data from Splunk SOAR via API and building a custom report.
   • BAsk each analyst to keep a personal log of their cases and submit it monthly.
   • CManually export all case data to a spreadsheet and calculate the metrics using formulas.
   • DCreate a dashboard in Splunk SOAR that uses the built-in case metrics and reporting features to display the required KPIs.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which feature in Splunk case management facilitates collaboration among analysts?

   • ACase ID
   • BCase comments
   • CCase priority
   • DCase status
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's SOAR playbook enriches every case with data from an external threat intelligence feed. This has significantly increased the time to create a case, and the SOC is falling behind on triage. The team wants to maintain enrichment but reduce the delay for critical cases. What is the best approach?

   • AModify the playbook to enrich critical cases synchronously and enrich lower-priority cases asynchronously or on-demand.
   • BRemove enrichment from the playbook entirely to speed up case creation.
   • CKeep the current playbook and accept the delay, as enrichment is always necessary.
   • DEnrich all cases after they are closed, so the data is available for reporting.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC has a limited number of senior analysts. They want to ensure that the most critical cases are handled by senior staff, but they also want to avoid overloading them with low-priority work. The current process assigns all cases to a general queue, and analysts pick them up manually. The SOC manager wants to automate the assignment so that cases with a severity of 'Critical' are assigned to a senior analyst, while 'High' and below go to a general pool. However, if no senior analyst is available, the critical case should be assigned to the most experienced analyst in the general pool. What is the most effective way to implement this?

   • ASet the case priority field to 'Critical' and rely on the case list sorting to bring them to the top.
   • BCreate two separate queues, one for senior analysts and one for the general pool, and instruct analysts to check both queues.
   • CCreate a playbook that checks the severity, assigns critical cases to a senior analyst, and has a fallback to assign to the general pool if no senior is available.
   • DAssign all cases to the general pool and let the senior analysts monitor the queue for critical cases.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a multi-day incident investigation, two analysts are working on the same case from different shifts. The first analyst adds a note containing a key indicator of compromise (IOC) and a hypothesis. The second analyst, starting their shift, needs to see this context and add their own findings without overwriting the first analyst's work. What is the best way to support this collaboration in Splunk SOAR?

   • AHave the second analyst email their findings to the first analyst to add later.
   • BUse the case's comment and note features to append a new note, preserving the original and providing a chronological history of the investigation.
   • CCreate a separate case for the second analyst's findings and link it to the original case.
   • DInstruct the second analyst to edit the first analyst's note to add their findings.
   Reveal Solution Discussion Select an answer first