Examkin

Question

Difficulty: HardSecurity Automation and Orchestration (SOAR)

An enterprise integrates a Security Orchestration, Automation, and Response (SOAR) platform to process phishing reports. The automated playbook extracts embedded URLs, checks them against threat intelligence feeds, and upon finding a positive match, executes an automated script that revokes the compromised user's directory account and isolates their host machine. During a routine business operation, a false-positive threat feed match triggers the playbook, causing the domain administrator account to be automatically disabled and isolating a primary domain controller. Which of the following modifications to the SOAR playbook logic best mitigates the risk of operational disruption while preserving automated triage efficiency?

  1. Insert a conditional decision node requiring Human-in-the-Loop (HITL) approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.Answer
  2. B
    Lower the threat intelligence API confidence threshold trigger so automated containment actions execute only when low-fidelity indicators are detected.
  3. C
    Reclassify the automated host isolation action from a corrective security control to a detective security control so domain controllers remain accessible during incident analysis.
  4. D
    Replace API key authentication between the SOAR platform and Active Directory with role-based authorization parameters on individual end-user workstations.

Answer

Inserting a conditional decision node requiring Human-in-the-Loop approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.
The correct option addresses the root cause of automated operational failure by introducing a Human-in-the-Loop (HITL) approval step for critical systems and privileged accounts. SOAR playbooks should automate low-risk investigation and triage tasks automatically, but high-impact containment actions against critical infrastructure (like domain controllers) must incorporate analyst authorization to prevent business disruption caused by false positives.

Step-by-Step Solution

1
Analyze the incident root cause
Unrestricted automated containment scripts disabled a critical asset (domain controller / admin account) based on a false-positive trigger.
Fully automated containment without asset-level safeguards creates significant operational exposure for enterprise infrastructure.
2
Evaluate SOAR orchestration governance controls
High-impact containment tasks (such as account revocation or server isolation) on tier-0 assets require approval gates.
Human-in-the-Loop (HITL) steps allow automated enrichment and triage to proceed rapidly while maintaining human oversight for critical disruption risks.
3
Select the optimal playbook design modification
Implement conditional branching that checks asset criticality tags and requires analyst sign-off before executing disruptive containment against core systems.
This preserves the speed of automated investigation while protecting organizational resilience.

Key Concept

SOAR Playbook Governance and Human-in-the-Loop (HITL) Safeguards
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic