Examkin

Question

Difficulty: EasySecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) team is designing an automated workflow to revoke access tokens across multiple cloud services whenever a credential leak is detected. Which component of a Security Orchestration, Automation, and Response (SOAR) platform executes these predefined, multi-step actions across disparate security tools?

  1. Automated playbooksAnswer
  2. B
    Threat intelligence feeds
  3. C
    Role-based access control policies
  4. D
    Manual containment procedures

Answer

Automated playbooks execute predefined multi-step actions across disparate security tools within a SOAR platform.
Automated playbooks within a SOAR platform sequence and execute predefined actions—such as calling APIs to revoke tokens or block IP addresses—across integrated platforms without manual intervention.

Step-by-Step Solution

1
Identify the operational requirement in the scenario.
The scenario describes executing predefined, automated multi-step response actions across multiple cloud services and security systems.
Understanding the need for programmatic action across distinct security tools isolates the core orchestration function.
2
Evaluate the role of SOAR components.
SOAR platforms use playbooks to codify incident response processes into automated workflows.
Playbooks integrate with APIs to automate complex remediation tasks such as revoking tokens or isolating hosts.

Key Concept

SOAR Automated Playbooks
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic