Explain the Use of SOAR Playbooks and List the Basic Ways They Can Be Triggered from Enterprise Security. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC team is using Splunk Enterprise Security and SOAR. They have a playbook that is triggered by an Adaptive Response action from a correlation search. The playbook is supposed to block a malicious IP at the firewall. However, the team notices that the playbook is not triggering at all. The correlation search is generating notable events, and the playbook is published. What is the most likely cause of the playbook not triggering?

   • AThe Adaptive Response action is not configured to trigger the playbook, or the action is disabled.
   • BThe SOAR platform is not connected to Enterprise Security.
   • CThe playbook is not associated with the 'notable' container type.
   • DThe notable event is not being created because the correlation search is not running.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which Enterprise Security feature allows a SOAR playbook to be launched automatically when a notable event is created?

   • AA dashboard panel that displays the playbook status
   • BA lookup table that maps event types to playbook names
   • CA scheduled report that emails the playbook output to the analyst
   • DAdaptive response action configured on the correlation search
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is manually running a SOAR playbook from a notable event in Enterprise Security. The playbook is designed to block a malicious domain. However, the analyst notices that the playbook is not appearing in the 'Run Playbook' action menu. The playbook is published and associated with the 'notable' container type. What is the most likely reason for this?

   • AThe Enterprise Security app is not properly connected to the SOAR platform.
   • BThe playbook is not active or enabled in the SOAR platform.
   • CThe notable event is not of the correct type or severity.
   • DThe analyst does not have the required permissions to run playbooks in Enterprise Security.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC team is designing a SOAR playbook for a 'Ransomware Detected' notable event. The playbook should perform the following actions in order: 1) Isolate the endpoint, 2) Block the ransomware hash, 3) Notify the incident response team. The team wants to ensure that if the isolation step fails, the playbook still attempts to block the hash and send the notification. What is the best way to configure the playbook?

   • AUse a decision block after the isolation step to check if it succeeded and only then proceed.
   • BRun the 'Block Hash' and 'Notify' steps in parallel with the 'Isolate' step.
   • CCreate a separate playbook for the 'Block Hash' and 'Notify' steps and call it from the main playbook.
   • DConfigure the 'Isolate Endpoint' step to 'Continue on failure' and keep the subsequent steps in a linear sequence.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise has a SOAR playbook that is triggered automatically by a correlation search for 'Malware Detected' notable events. The playbook isolates the affected endpoint and blocks the associated file hash. Recently, the SOC team has noticed that the playbook is isolating endpoints that are part of a critical business application, causing significant downtime. They want to prevent this while still automating the response for non-critical endpoints. What is the most effective way to modify the playbook to address this issue?

   • ACreate a separate correlation search and playbook for critical endpoints that only sends a notification.
   • BModify the correlation search to only generate notable events for non-critical endpoints.
   • CAdd a decision block that checks the endpoint's criticality (e.g., via a lookup or asset tag) and only isolates if it is not critical.
   • DDisable the automatic trigger and require analysts to manually run the playbook for each event.
   Reveal Solution Discussion Select an answer first