Examkin

Question

Difficulty: HardSecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) configures an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-severity data exfiltration alerts originating from enterprise database servers. Place the operational playbook steps in the correct execution sequence from initial trigger to incident documentation.

  1. 1Parse telemetry from the network detection sensor to extract source IP addresses, destination domain names, and active connection handles.
  2. 2Query CMDB and IAM systems via API to determine database server criticality, data classification, and logged-in user accounts.
  3. 3Submit destination domains and process binaries to internal threat intelligence feeds and sandbox analysis tools for score verification.
  4. 4Evaluate conditional safety rules for high-criticality assets and execute automated network isolation via the Endpoint Detection and Response (EDR) API.
  5. 5Create an escalated incident ticket in the ITSM platform containing full triage artifacts and trigger an on-call analyst webhook notification.

Answer

The correct execution order is: 1) Ingest and parse sensor telemetry, 2) Query CMDB/IAM for asset criticality enrichment, 3) Perform threat intelligence and sandbox validation, 4) Execute conditional EDR host isolation, and 5) Generate the ITSM incident ticket with team escalation.
A SOAR incident response playbook follows a structured lifecycle: Alert Ingestion & Parsing -> Context Enrichment (CMDB/IAM) -> Threat Intelligence Validation -> Conditional Containment (EDR Isolation) -> Ticket Generation & Notification. This sequence minimizes false-positive impact and ensures containment occurs prior to manual analyst handoff.

Step-by-Step Solution

1
Ingest and parse the raw alert telemetry.
Extracted indicators of compromise (IPs, domains, process handles) ready for downstream API calls.
Automation workflows cannot run query functions without extracted parameters from the initial alert trigger.
2
Enrich the event with asset and identity context.
Established server business impact score and assigned owner.
Knowing asset criticality is required before evaluating automated isolation risk logic.
3
Query threat intelligence and submit binaries for sandbox analysis.
Confirmed malicious reputation score for outbound connection targets.
Validation ensures containment triggers only on verified threat indicators rather than false positives.
4
Perform conditional safety check and execute isolation.
Affected database host isolated from network segment via EDR API.
Rapid containment prevents data loss while abiding by predefined high-availability safety checks.
5
Document and escalate in ITSM.
Ticket populated with enriched telemetry logs and on-call analyst notified.
Saves analyst time by delivering fully triaged context and containment status for manual investigation.

Key Concept

SOAR Playbook Execution Sequencing
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic