Examkin

Question

Difficulty: EasySecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) analyst wants to standardize and automate the incident response steps for phishing alerts. The workflow needs to automatically extract suspicious URLs, query threat intelligence sources, and isolate affected endpoints without manual intervention. Which SOAR component should the analyst configure to execute this automated sequence of actions?

  1. A security playbookAnswer
  2. B
    A SIEM log correlation rule
  3. C
    A threat intelligence data feed
  4. D
    An identity authentication gateway

Answer

A security playbook is the SOAR component used to execute automated, multi-step incident response workflows.
A security playbook is a automated linear or conditional script used by SOAR platforms to orchestrate incident response processes across connected systems. It allows SOC teams to automate repeated tasks such as extracting indicators, querying threat feeds, and isolating compromised hosts.

Step-by-Step Solution

1
Identify the primary operational requirement in the scenario.
The requirement is to define and execute an automated sequence of multi-tool actions (triage, threat lookup, endpoint isolation).
Understanding the goal distinguishes detection mechanisms from automation and orchestration mechanisms.
2
Evaluate the capabilities of Security Automation and Orchestration (SOAR).
SOAR uses playbooks (or runbooks) to codify step-by-step incident response workflows into executable logic using APIs.
Playbooks provide the automated conditional logic required to coordinate tasks across distinct security tools.

Key Concept

SOAR Playbooks and Automated Response
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic