Examkin

Soru

Zorluk: KolaySecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) team wants to create a workflow that automatically extracts file hashes from suspicious email alerts and queries external threat intelligence platforms. Which key component of a Security Orchestration, Automation, and Response (SOAR) platform enables integration and communication between these disparate security tools?

  1. API connectors and integration pluginsCevap
  2. B
    High-fidelity automated isolation rules targeting core infrastructure
  3. C
    Detective control classification frameworks
  4. D
    User authorization permission matrices

Cevap

API connectors and integration plugins enable SOAR platforms to communicate with external security tools and threat intelligence services.
API connectors and integration plugins provide the technical interfaces necessary for a SOAR solution to send requests and pull data from external platforms, such as threat intelligence feeds, SIEMs, and endpoint management software.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario.
The requirement is enabling interoperability and automated communication between distinct security platforms.
SOAR platforms aggregate data and trigger actions across different tools in the security stack.
2
Evaluate the technical mechanism used by SOAR to connect disparate tools.
SOAR uses API connectors and integration modules to send and receive data from external systems.
APIs provide standard protocols for automated data exchange between platforms without human intervention.

Anahtar Kavram

SOAR Integration and API Orchestration
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru