Examkin

Question

Difficulty: MediumSecurity Automation and Orchestration (SOAR)

An analyst is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to respond to API token abuse detected by a SIEM. The playbook must automatically mitigate active malicious access while minimizing operational disruption to critical cloud workloads. Which of the following automated actions should be incorporated into the playbook containment workflow? (Select TWO.)

  1. Revoke the affected API access token via API calls to the Identity and Access Management (IAM) provider.Answer
  2. Quarantine active user sessions associated with the compromised credential to force re-authentication.Answer
  3. C
    Automatically shut down all production API gateway instances connected to the target application.
  4. D
    Reassign the affected identity to an administrative role to grant read-only forensic access.

Answer

The correct automated containment actions are revoking the compromised API access token via IAM integration and quarantining active user sessions associated with the credential to force re-authentication.
Automated SOAR playbooks should execute targeted actions that eliminate unauthorized access without causing broad outages. Revoking the specific compromised API access token directly removes the attacker's entry mechanism. Simultaneously, invalidating active sessions associated with the user account forces re-authentication, preventing further exploitation while limiting operational impact to unaffected systems.

Step-by-Step Solution

1
Identify targeted containment controls for API token compromise.
Disabling the specific revoked token stops unauthorized API requests directly at the identity layer.
Targeted token revocation neutralizes the active threat vector immediately without impacting other infrastructure.
2
Enforce session invalidation.
Terminating active sessions linked to the identity prevents persistent session exploitation.
Forcing re-authentication validates user identity while cutting off stolen session tokens.
3
Evaluate potential side effects of over-broad automated actions.
Shutting down core API gateways creates self-inflicted downtime, while escalating roles increases security risks.
SOAR playbooks must balance automated response speed with service availability and least privilege principles.

Key Concept

SOAR Automated Containment and Playbook Safety Controls
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic