Examkin

Question

Difficulty: MediumSecurity Automation and Orchestration (SOAR)

A security analyst is configuring an automated SOAR workflow to respond to account compromise indicators stemming from impossible travel alerts. Which of the following automated actions should be incorporated into the playbook to ensure immediate identity containment while avoiding unintended enterprise disruptions? (Select TWO.)

  1. Revoke all active OAuth and session tokens for the impacted user account across identity providers.Answer
  2. Enforce mandatory step-up multi-factor authentication (MFA) on all subsequent login requests for the user.Answer
  3. C
    Trigger an automated host isolation script on the primary domain controller handling the authentication request.
  4. D
    Reassign the user's role-based access control (RBAC) group memberships to read-only guest permissions.

Answer

Revoking active OAuth and session tokens across identity providers and enforcing mandatory step-up multi-factor authentication (MFA) on subsequent logins.
Revoking active session tokens immediately terminates unauthorized access, while enforcing step-up multi-factor authentication prevents secondary compromised logins. These target the identity layer safely without disrupting surrounding infrastructure.

Step-by-Step Solution

1
Evaluate containment actions suitable for automated identity compromise response.
Identify actions that target identity sessions directly without impacting shared identity infrastructure.
SOAR playbooks must balance rapid response with business continuity guardrails.
2
Select immediate session revocation and mandatory step-up MFA challenges.
Existing sessions are immediately invalidated, and new sessions are blocked without secondary verification.
Combining token revocation with step-up MFA neutralizes active access and prevents re-entry.
3
Reject high-risk infrastructure isolation and ineffective access control adjustments.
Avoid isolating core domain controllers or altering RBAC rights while sessions remain open.
Host isolation on core infrastructure causes service outages, and authorization modifications do not kill existing session tokens.

Key Concept

SOAR Identity Containment Playbooks and Session Revocation
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic