Examkin

Question

Difficulty: Very hardSecurity Automation and Orchestration (SOAR)

An enterprise web application triggers a high-severity alert indicating that an active OAuth access token is simultaneously originating requests from two geographically disparate IP addresses. A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to remediate the account takeover attempt while preserving evidence. Place the following SOAR automated playbook steps into the correct execution sequence from first to last.

  1. 1Ingest the API Gateway anomaly webhook event containing the compromised OAuth token ID and source IP addresses.
  2. 2Query the Threat Intelligence Platform (TIP) and Identity Provider (IdP) logs to collect IP reputation scores and user session metadata.
  3. 3Execute API requests to the Identity Provider (IdP) to revoke active OAuth refresh tokens and terminate all current user sessions.
  4. 4Push automated API commands to the Web Application Firewall (WAF) to temporarily block the malicious originating IP addresses.
  5. 5Create an enriched incident ticket in the ITSM platform and attach the API payload logs and enrichment artifacts for analyst review.

Answer

The correct operational sequence for the SOAR playbook is: 1) Ingest the API Gateway anomaly webhook event, 2) Query threat intelligence and identity logs for enrichment, 3) Execute API requests to revoke OAuth tokens and terminate user sessions, 4) Push automated API commands to the WAF to block malicious IPs, and 5) Create an enriched ITSM incident ticket with attached forensic artifacts.
A standard SOAR automated incident response workflow adheres to a strict logical lifecycle. First, the playbook ingests the security alert payload from the detection system (API Gateway). Second, it queries external Threat Intelligence Platforms and Internal Identity Providers to enrich the alert with reputation scores and session metadata. Third, it performs identity-level containment by revoking active OAuth tokens and invalidating sessions via API integrations to neutralize compromised credentials instantly. Fourth, it enforces perimeter network filtering at the WAF to block malicious source IPs. Finally, it documents all orchestration actions, attaches collected evidence, and opens/updates an ITSM ticket for analyst review.

Step-by-Step Solution

1
Trigger & Ingestion
The SOAR platform receives the initial security event payload from the API Gateway.
Automation workflows cannot process data until the initial alert webhook is ingested into the orchestration engine.
2
Automated Contextual Enrichment
IP reputation scores and IdP session details are attached to the incident context.
Enrichment provides necessary context and validates the anomaly before executing destructive containment actions.
3
Identity & Account Containment
The compromised token is revoked and active user sessions are terminated.
Direct identity containment prevents further authenticated access regardless of the attacker's network location.
4
Infrastructure & Perimeter Containment
Network traffic from the attacker's IP addresses is dropped at the WAF boundary.
Network mitigation blocks ongoing unauthenticated scan or attack traffic from the malicious source IPs.
5
Documentation & ITSM Escalation
An incident ticket is updated with full audit trails, context, and mitigation status.
Recording automated actions ensures compliance, chain of custody, and operational visibility for SOC analysts.

Key Concept

SOAR Playbook Execution Order (Ingestion -> Enrichment -> Containment -> Documentation)
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic