Examkin

Question

Difficulty: HardSecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) is designing a high-velocity Security Orchestration, Automation, and Response (SOAR) playbook to automatically mitigate risks when an active cloud API access key is detected in a public repository leak. To maintain service availability while ensuring rapid threat containment and contextual enrichment, which of the following response actions should be executed as automated steps without requiring manual human approval? (Select TWO.)

  1. Deactivating the specific exposed API access key via automated integration calls to the Cloud Service Provider management APIAnswer
  2. Querying threat intelligence API endpoints to append risk scores and context for originating IP addresses directly into the incident ticketAnswer
  3. C
    Triggering an automated hard power-down of all production virtual machine instances associated with the cloud tenant
  4. D
    Modifying application security group role permissions to perform identity verification of the API caller

Answer

The correct response actions are deactivating the specific exposed API access key via Cloud Service Provider API integration and querying threat intelligence API endpoints to append risk context to the incident ticket.
Deactivating the specific exposed API key directly addresses the compromised secret at the management plane without causing unintended outages to compute resources. Querying threat intelligence sources to enrich incident tickets is a standard automated SOAR practice that increases analyst velocity without operational risk.

Step-by-Step Solution

1
Evaluate containment actions for operational risk vs. threat mitigation
Deactivating the compromised API key via CSP integration neutralizes the vector immediately without shutting down host servers or network workloads.
Targeted credential disabling isolates the attack vector safely without risking collateral downtime.
2
Identify non-disruptive enrichment tasks suitable for full automation
Automating threat intelligence lookups and appending IP reputation scores to the alert ticket provides SOC analysts with instant context.
Enrichment activities carry zero risk of operational disruption and dramatically reduce mean time to respond (MTTR).
3
Analyze distractor actions for operational logic errors and control category confusion
Hard rebooting production instances causes unacceptable outages. Modifying authorization roles confuses permission assignment with authentication verification.
Automated playbooks must avoid disruptive system-wide containment actions without human-in-the-loop approval.

Key Concept

SOAR Playbook Automated Actions vs. Human-in-the-Loop Safeguards
Rate this question

Topics

Security Automation and Orchestration (SOAR)

More questions from this topic