A Security Operations Center (SOC) team deploys an automated Security Orchestration, Autom… — CompTIA Security+

A Security Operations Center (SOC) team deploys an automated Security Orchestration, Automation, and Response (SOAR) playbook designed to mitigate rapid ransomware propagation. The playbook triggers automatically upon receiving high-severity Endpoint Detection and Response (EDR) telemetry, querying external threat intelligence APIs to verify file hashes before calling a Network Access Control (NAC) API to isolate the host network interface. During a red-team simulation, synthetic high-volume alert telemetry from an active primary domain controller causes the playbook to execute auto-isolation on the server, resulting in an immediate domain-wide operational outage. Which modification to the SOAR playbook logic or execution configuration best mitigates the operational risk of automated service disruption while maintaining rapid containment capabilities for verified threats?

Implement conditional asset tagging with human-in-the-loop approval gates for tier-0 infrastructure alongside scoped containment actions such as perimeter firewall blocking instead of full interface isolation.Cevap
B
Lower the EDR alert severity trigger threshold in the playbook so that automated host isolation occurs before high telemetry volume is accumulated by critical servers.
C
Reclassify the automated NAC host isolation task from a corrective control to a detective control in the SOAR playbook metadata framework.
D
Update the SOAR service account credentials to require multi-factor authentication interactive prompts whenever calling the NAC authorization API endpoints.

Cevap

Implementing asset-aware conditional logic with human-in-the-loop (HITL) approval gates for critical tier-0 infrastructure and utilizing scoped containment controls best balances operational availability with incident response automation.

The correct answer addresses the root cause of the outage by introducing asset awareness and conditional execution paths into the SOAR playbook logic. For critical infrastructure (such as domain controllers or key database servers), automated full-network isolation poses a greater risk to business continuity than the threat itself. Implementing human-in-the-loop (HITL) approval gates or lower-impact microsegmentation/egress filtering preserves security operations without causing enterprise-wide outages.

Adım Adım Çözüm

Analyze the operational vulnerability in the existing automated playbook

The SOAR playbook performs aggressive automated network interface isolation indiscriminately on any host, including critical tier-0 domain controllers.

Automated containment actions must evaluate the operational criticality of the target system to prevent self-inflicted denial-of-service events.

Evaluate containment actions based on risk and asset classification

Tier-0 systems require human-in-the-loop approval or non-disruptive scoped containment (e.g., blocking outbound external traffic rather than full port shutdown).

Asset awareness in playbooks ensures that high-impact automated actions are constrained when applied to critical enterprise services.

Differentiate effective logic fixes from misconfigured or non-functional options

Changing thresholds increases false positives, reclassifying control metadata does not change execution behavior, and imposing interactive MFA breaks system-to-system API authentication.

Only logic adjustments incorporating asset tags and approval workflow gates properly resolve the operational risk.

Anahtar Kavram

SOAR Playbook Design & Safety Controls

Tahmini Süre:2m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru