Examkin

Soru

Zorluk: Çok zorSecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) team is designing an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate Active Directory Kerberoasting attacks detected by SIEM log correlations. The attack patterns involve rapid requests for Service Principal Name (SPN) tickets across domain accounts. If the SOAR playbook executes unvalidated credential resets across all flagged accounts, critical production services using Group Managed Service Accounts (gMSAs) will experience severe outages. Which of the following playbook logic designs correctly balances automated response speed with operational risk mitigation for Tier-0 identity infrastructure?

  1. Implement conditional branching that parses asset tags and account attributes, automatically enforcing ticket-granting restrictions on standard user accounts while routing service account remediation to a Human-in-the-Loop (HITL) approval queue.Cevap
  2. B
    Configure an immediate, unconditioned execution step that forces a domain-wide password reset and session invalidation for every account associated with a requested SPN upon initial alert detection.
  3. C
    Deploy an inline host-based firewall rule on all Domain Controllers via SOAR webhook API calls to block port 88 (Kerberos) traffic globally whenever ticket request thresholds are breached.
  4. D
    Replace the SOAR API connector's OAuth 2.0 bearer token authentication with static API keys to grant the orchestrator administrative rights to decrypt Kerberos ticket payloads directly.

Cevap

The correct playbook logic uses conditional branching based on asset tags and account types, automating containment for standard user accounts while utilizing Human-in-the-Loop (HITL) approvals for critical service accounts.
The option advocating conditional branching combined with Human-in-the-Loop (HITL) approval correctly balances threat containment with business continuity. By distinguishing between standard user accounts and mission-critical Group Managed Service Accounts (gMSAs), the SOAR playbook can rapidly restrict compromised user tickets while preventing catastrophic outages on Tier-0 identity infrastructure.

Adım Adım Çözüm

1
Evaluate operational impact vs automated containment speed
Identified that automated actions on critical service accounts (gMSAs) present severe downtime risks.
SOAR playbooks must account for asset criticality to prevent self-inflicted outages during automated response.
2
Implement conditional logic and enrichment in the SOAR workflow
Branch workflow paths based on account classification (user vs service account).
Enables immediate automated isolation for low-impact user accounts while protecting critical infrastructure.
3
Integrate Human-in-the-Loop (HITL) safeguards
Require manual analyst authorization before executing disruptive changes on service accounts.
Provides a safety check for high-tier assets while preserving overall response orchestration efficiency.

Anahtar Kavram

SOAR Playbook Design and Operational Risk Safeguards
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru