Examkin

Question

Difficulty: HardSecurity Automation and Orchestration (SOAR)

A Security Orchestration, Automation, and Response (SOAR) platform is configured with an automated containment playbook that ingests high-severity SIEM alerts indicating Kerberoasting attacks. Upon detecting rapid requests for Service Principal Name (SPN) tickets, the playbook automatically revokes all active Kerberos tgt tokens and disables the associated Active Directory account. During a night-shift database backup, a critical core service account triggers a false-positive alert, causing automated account suspension that results in an enterprise-wide application outage. Which playbook modification best mitigates the operational risk while maintaining automated threat response capabilities?

  1. Insert a conditional decision node into the playbook that verifies an asset criticality allowlist and routes critical service accounts to a human-in-the-loop (HITL) approval step before disabling the account.Answer
  2. B
    Adjust the playbook execution logic to increase the SIEM correlation trigger threshold from 5 SPN requests to 50 SPN requests per minute without adding approval conditions.
  3. C
    Reclassify the automated account suspension action from a corrective security control to a detective control within the playbook configuration settings.
  4. D
    Configure the automated script to issue a secondary OAuth authentication challenge to the affected service account prior to evaluating its privilege authorization rights.

Answer

Insert a conditional decision node into the playbook that verifies an asset criticality allowlist and routes critical service accounts to a human-in-the-loop (HITL) approval step before disabling the account.
Automated security response actions against critical operational assets carry severe risk of collateral damage. Introducing a conditional node based on asset tagging or allowlists allows the SOAR platform to apply immediate automated containment for standard endpoints while routing high-impact accounts (such as domain controllers or core service accounts) to a Human-in-the-Loop (HITL) manual approval step.

Step-by-Step Solution

1
Analyze the operational incident root cause.
Unconditional automated suspension of critical service accounts led to a major business service outage.
Fully automated containment without asset sensitivity context creates high operational availability risk.
2
Evaluate SOAR playbook optimization strategies.
Distinguish between non-critical user accounts (fully automated containment) and mission-critical service accounts (human-in-the-loop oversight).
Conditional branching allows security teams to maintain high-speed automation where safe, while enforcing mandatory analyst verification for high-impact infrastructure assets.
3
Select the appropriate control architecture.
Integrating an allowlist check and human approval workflow balances containment speed with operational resilience.
This directly mitigates accidental service disruption during false positives or routine automated operations.

Key Concept

SOAR Playbook Design and Human-in-the-Loop (HITL) Governance
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic