Explain the Use of SOAR Playbooks and List the Basic Ways They Can Be Triggered from Enterprise Security. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC team is designing a SOAR playbook to handle a malware outbreak. The playbook should first check if the affected endpoint is a critical server. If it is, the playbook should send a notification to the on-call engineer and NOT isolate the endpoint. If it is not a critical server, the playbook should isolate the endpoint. What is the best way to structure this playbook?

   • AUse a decision block that checks the endpoint's criticality and then branches to the appropriate actions.
   • BAlways isolate the endpoint and then send a notification if it was a critical server.
   • CCreate two separate playbooks: one for critical servers and one for non-critical servers, and manually choose which to run.
   • DUse a custom script in the playbook to perform the criticality check and then call different playbooks.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In Splunk Enterprise Security, which of the following is a standard way to trigger a SOAR playbook?

   • ABy running a playbook directly from a notable event's action menu
   • BBy scheduling a playbook to run every hour using a cron job in the SOAR platform
   • CBy configuring a data input monitor that watches a file for new log lines
   • DBy writing a custom REST API call that runs the playbook on a fixed timer
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations center (SOC) wants to ensure that every time a specific high-priority notable event is created in Enterprise Security, a SOAR playbook automatically runs to enrich the event with threat intelligence and isolate the affected endpoint. The team does not want analysts to have to manually trigger the playbook each time. What is the most appropriate way to configure this automation?

   • AUse a REST API call from the SOAR platform to poll Enterprise Security for new notable events.
   • BInstruct analysts to click the 'Run Playbook' button every time they see the notable event.
   • CSet up a scheduled search in Enterprise Security that runs every minute and checks for the notable event, then triggers the playbook via a script.
   • DConfigure the playbook to be triggered by an Adaptive Response action that is automatically invoked by a correlation search.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst is reviewing a SOAR playbook that was triggered by a notable event. The playbook has several steps, and the analyst wants to understand what each step is doing and why. What is the best way for the analyst to get this information?

   • AView the playbook's execution history and details in the SOAR platform.
   • BLook at the raw logs of the systems that the playbook interacted with.
   • CCheck the notable event's 'Playbook' tab in Enterprise Security.
   • DAsk the playbook's author for a written explanation of the playbook.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC manager is evaluating the use of SOAR playbooks to improve the incident response process. They want to understand the primary benefit of using playbooks for repetitive tasks like IP blocking and malware containment. What is the most significant advantage?

   • AThey automatically resolve all security incidents without any manual intervention.
   • BThey provide a graphical interface for analysts to manually execute steps.
   • CThey completely eliminate the need for human analysts in the response process.
   • DThey ensure consistent and repeatable execution of response actions.
   Reveal Solution Discussion Select an answer first