A security operations team deploys an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate compromised account alerts. The playbook is designed to connect to the organization's identity provider and immediately invalidate active session tokens when high-confidence alert criteria are met. During testing, the SOAR workflow successfully authenticates using API credentials but fails when attempting to execute the token revocation call, returning an HTTP 403 Forbidden response. Which of the following best explains why this automated remediation step failed?
- The SOAR service account successfully authenticated but lacked the authorization permissions required to modify user session states.Cevap
- BThe playbook experienced an authentication failure because the identity provider was unable to verify the credentials of the SOAR platform.
- CThe playbook trigger logic contained a syntax error that halted workflow execution prior to making the remediation API call.
- DThe session invalidation action was automatically blocked because automated SOAR actions function exclusively as detective security controls.
Cevap
The SOAR service account successfully authenticated but lacked the authorization permissions required to modify user session states.
The correct answer identifies that the SOAR service account was authenticated properly but failed due to missing authorization rights. Authentication confirms who the service account is, while authorization determines what actions the service account can perform. An HTTP 403 Forbidden status confirms that identity was verified successfully, but the identity provider denied the request because the account lacked the requisite administrative privileges to revoke user sessions.
Adım Adım Çözüm
Anahtar Kavram
Authentication vs. Authorization in SOAR API Integrations
Tahmini Süre:1m 30s