Examkin

Soru

Zorluk: OrtaSecurity Automation and Orchestration (SOAR)

A security operations center (SOC) team is deploying a Security Orchestration, Automation, and Response (SOAR) playbook to handle automated containment when secret-scanning tools detect exposed API keys in public code repositories. In what sequence should the SOAR engine execute the following playbook steps?

  1. 1Ingest the alert payload from the secret-scanning API containing the exposed API key token metadata.
  2. 2Query internal Identity and Access Management (IAM) and Asset Management APIs to enrich context regarding the key owner and scope.
  3. 3Evaluate conditional decision logic to determine whether the key belongs to a production environment or a test environment.
  4. 4Invoke the Cloud IAM API to immediately invalidate the compromised key and revoke active session tokens.
  5. 5Generate a high-priority ticket in the ITSM system and dispatch an automated notification to the service owner.

Cevap

The correct execution sequence is: 1) Ingest the alert payload from the secret-scanning API, 2) Query internal IAM and Asset Management APIs for enrichment, 3) Evaluate conditional decision logic for environment context, 4) Invoke the Cloud IAM API to invalidate the compromised key, and 5) Generate an ITSM ticket and dispatch notifications.
A standard SOAR playbook follows a structured workflow starting with event ingestion, followed by threat intelligence and identity enrichment to establish context. After enrichment, conditional logic determines the appropriate response path. Once conditions are satisfied, automated containment APIs execute to mitigate the threat immediately, followed by post-containment ticketing and team notifications.

Adım Adım Çözüm

1
Trigger and Ingestion
The SOAR platform receives the alert payload containing the exposed credential metadata from the external repository monitor.
Execution cannot begin until the raw alert event and initial parameters are ingested by the orchestration tool.
2
Context Enrichment
The playbook queries internal systems to correlate the token string with internal identity records, environment tags, and privilege levels.
Raw alert tokens lack necessary business and technical context needed for safe, effective automated decision-making.
3
Conditional Evaluation
The playbook branch logic evaluates whether automated containment rules apply to the specific account and system environment.
Decision gates must evaluate enriched data before taking disruptive containment steps on live cloud infrastructure.
4
Automated Containment
The SOAR engine executes API integration scripts to revoke the exposed key and kill associated active sessions.
Neutralizing the active vector is the key containment objective once conditions and identity scope are validated.
5
Notification and Record Keeping
An incident record is created in the ticketing system and notifications are routed to the asset owner for manual key re-issuance.
Administrative documentation and human-in-the-loop follow-up tasks occur after successful automated threat containment.

Anahtar Kavram

SOAR Playbook Execution Lifecycle (Trigger -> Enrich -> Evaluate -> Contain -> Notify)
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru