Optimize Case Management. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A SOC manager wants to automate the escalation of cases that have not been updated in 24 hours. However, they are concerned about alert fatigue from too many notifications. They want to ensure that the assigned analyst is notified first, and the team lead is only notified if the analyst does not respond within 4 hours. What is the best way to implement this multi-tier escalation?

   • ACreate a single playbook that sends a notification to both the analyst and the team lead at the same time after 24 hours.
   • BCreate a playbook that runs every hour and checks if the case is older than 24 hours, then notifies the team lead.
   • CRely on the case status field to show 'Overdue' and let the team lead check a dashboard.
   • DCreate two playbooks: one that runs at 24 hours to notify the analyst, and another that runs at 28 hours to notify the team lead if the case is still not updated.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A healthcare organization is subject to regulations that require a complete record of who accessed a case, what changes were made, and when. The compliance officer asks the SOC manager to prove that the case management system can provide this information for an audit. What should the SOC manager demonstrate?

   • AThe analyst's personal notes, which they are required to keep in a separate document.
   • BThe audit log feature, which records user actions, timestamps, and changes made to cases.
   • CThe case status field, which shows the current state of the case.
   • DThe case notes field, which shows the final text of all comments.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC manager wants to identify bottlenecks in the incident response process. They suspect that cases are taking too long between the 'Triage' and 'Investigation' stages. What is the most direct way to analyze this in Splunk SOAR?

   • AAsk analysts to estimate how long they spend on each stage and compile the estimates.
   • BLook at the total time to close cases and assume the bottleneck is in the investigation stage.
   • CReview the audit log for each case to manually calculate the time between status changes.
   • DCreate a report that measures the average duration of cases in each status, focusing on the transition from 'Triage' to 'Investigation'.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of sharing case notes and updates in Splunk?

   • ATo generate a compliance report
   • BTo change the case priority
   • CTo keep all analysts informed about the case's progress
   • DTo automatically escalate the case
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of case metrics and reporting in Splunk?

   • ATo enrich cases with threat intelligence
   • BTo manage case ownership
   • CTo track case volume and resolution times
   • DTo automate case assignment
   Reveal Solution Discussion Select an answer first