Examkin

Question

Difficulty: MediumSecurity Automation and Orchestration (SOAR)

During a high-volume credential stuffing campaign targeted at an enterprise web portal, an automated Security Orchestration, Automation, and Response (SOAR) playbook is triggered upon detecting repeated failed authentication alerts. To rapidly mitigate the active attack while minimizing the risk of self-inflicted service outages on critical infrastructure, which of the following actions should be configured as the initial automated response step in the playbook?

  1. Dynamically apply a temporary perimeter firewall drop rule for the external source IP addresses associated with the failed login requests while querying threat intelligence feeds for enrichment.Answer
  2. B
    Automatically disable the network interface of the primary active directory authentication server hosting the targeted user accounts.
  3. C
    Append a detective event tag to the central SIEM correlation engine without triggering network isolation or account state changes.
  4. D
    Modify the role-based access control authorization policies to revoke resource permissions for the targeted end-user identity accounts.

Answer

Dynamically applying a temporary perimeter firewall drop rule for the external source IP addresses associated with the failed login requests while querying threat intelligence feeds for enrichment.
The correct response dynamically blocks the external source IP addresses carrying out the attack at the perimeter while enriching alert data via threat intelligence. This encapsulates the core purpose of Security Automation and Orchestration (SOAR)—executing rapid, low-risk containment steps automatically while preserving system availability.

Step-by-Step Solution

1
Identify the primary goal of automated SOAR incident response containment.
The objective is to stop malicious ingress traffic rapidly while preserving infrastructure availability.
Effective automation must balance rapid threat containment against operational risk to core business services.
2
Evaluate the operational scope of perimeter blocking versus internal infrastructure shutdown.
Blocking external malicious IP addresses at the perimeter mitigates attack traffic without taking down internal authentication services or revoking legitimate user access rights.
Targeting external attack vectors at the boundary avoids collateral damage to internal systems.

Key Concept

Security Automation Playbook Design and Risk-Aware Containment
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic