Optimize Case Management. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In Splunk, what does triage of a case involve?

   • AAdding a comment to the case
   • BRouting the case to the appropriate team or analyst
   • CGenerating a report on case volume
   • DDeleting the case from the system
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company uses Splunk SOAR for case management. They have a playbook that, upon case creation, enriches the case with threat intelligence and then automatically blocks the associated IP on the firewall. During a recent incident, the automatic block action failed because the firewall API was temporarily down. The case was still created and enriched, but the block was not performed. The team wants to ensure that failed actions are retried and that the case is not closed until all response actions are successful. What is the best approach?

   • AModify the playbook to include a retry loop for the firewall action and add a check that prevents case closure if the action failed.
   • BKeep the playbook as is and rely on the analyst to manually block the IP if they notice the failure in the action history.
   • CChange the case status to 'Blocked' when the firewall action fails, so it is visible to the team.
   • DCreate a separate playbook that runs on a schedule and checks for cases with failed actions, then blocks the IP.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which task is a typical example of an automated case management workflow?

   • ASending a notification when a case is escalated
   • BDeciding case closure
   • CManually entering case notes
   • DReviewing case evidence
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) receives a high volume of phishing alerts. The team lead wants to ensure that alerts tagged as 'critical' by the detection pipeline are immediately visible to senior analysts, while lower-severity alerts are queued for review during the next shift. The SOC uses Splunk SOAR case management. What should the team lead configure to meet this requirement?

   • ASet up a dashboard that filters cases by severity so senior analysts can manually refresh it to see critical cases.
   • BConfigure a case workflow that automatically sets the priority field based on the alert severity and routes high-priority cases to a senior analyst queue.
   • CCreate a case status of 'In Progress' for critical alerts and 'New' for all others, then manually assign critical cases to senior analysts.
   • DChange the case lifecycle so that all cases start in 'Closed' status and are reopened only when an analyst manually reviews them.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC manager notices that cases are often left in 'New' status for hours because analysts forget to update them. The manager wants to automatically notify the assigned analyst and the team lead if a case has not been updated within 30 minutes of assignment. What is the most effective way to achieve this?

   • AConfigure the case status field to automatically change to 'Overdue' after 30 minutes.
   • BCreate a scheduled playbook that runs every 15 minutes, finds cases in 'New' status older than 30 minutes, and sends a notification.
   • CSend an email to the team lead at the end of the day listing all cases that were not updated.
   • DAsk analysts to set a personal timer for each case they are assigned.
   Reveal Solution Discussion Select an answer first