Examkin

Question

Difficulty: HardSecurity Automation and Orchestration (SOAR)

Following an influx of fileless malware alerts detected by an Endpoint Detection and Response (EDR) solution, a Security Operations Center (SOC) team is refining an automated Security Orchestration, Automation, and Response (SOAR) playbook. During initial testing, a high-severity alert triggered the playbook to automatically isolate a primary Domain Controller, causing a critical network outage. Which playbook design modification BEST balances rapid threat containment with enterprise operational resilience to prevent future accidental outages?

  1. Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.Answer
  2. B
    Lower the playbook trigger threshold to execute automated network isolation on all hosts indiscriminately upon any medium or high severity alert.
  3. C
    Replace the automated host isolation action with a script that generates a detective log tag within the SIEM to complete the incident response workflow.
  4. D
    Configure the SOAR API integration to grant the orchestration service account full domain administrative rights to bypass host-level authentication checks.

Answer

Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.
Implementing conditional evaluation of asset tags—mandating analyst approval prior to isolating critical systems like Domain Controllers while permitting automatic containment for standard endpoints—strikes the correct balance between rapid threat mitigation and enterprise system availability.

Step-by-Step Solution

1
Analyze the incident trigger and operational impact
Identified that unvalidated, fully automated isolation of critical core assets (such as Domain Controllers) introduces high risk of self-inflicted service outages.
SOAR playbooks must balance containment velocity against the operational impact of false positives or unvalidated high-severity alerts.
2
Evaluate risk mitigation strategies within playbook logic
Determined that integrating asset tag evaluation (e.g., critical infrastructure vs. standard endpoint) enables contextual response pathways.
Standard workstation endpoints can be automatically contained immediately, whereas critical infrastructure assets can route to an analyst queue for quick manual validation.
3
Select the optimal playbook containment design
Incorporating conditional branching and human-in-the-loop approval for critical assets prevents unplanned operational downtime while retaining rapid automated response for non-critical systems.
This approach preserves enterprise availability while preserving automated containment capabilities across the rest of the environment.

Key Concept

SOAR Automated Response Playbook Design and Asset-Aware Containment Logic
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic