Examkin

Soru

Zorluk: ZorSecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) is designing an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle high-severity alerts triggered when an Amazon S3 storage bucket hosting confidential customer data is modified to allow public read access. The playbook must rapidly mitigate public data exposure while ensuring operational continuity for legitimate internal microservices that depend on the bucket. Which TWO of the following design choices should be incorporated into the automated response playbook to achieve effective containment without causing catastrophic service disruption?

  1. Configure an automated playbook action to invoke cloud API webhooks that immediately apply an explicit 'Block Public Access' policy to the bucket while leaving authenticated IAM roles intact.Cevap
  2. B
    Program the playbook to automatically delete the bucket and its objects immediately upon alert ingestion to guarantee zero unauthorized external data egress.
  3. Include an automated enrichment step that queries cloud audit logs for recent policy change events and appends access metadata to the incident ticket prior to triggering analyst notifications.Cevap
  4. D
    Deploy an inline endpoint intrusion prevention system (IPS) agent directly onto the cloud object storage service to dynamically filter incoming public HTTP requests.

Cevap

The correct playbook design choices are to invoke cloud API webhooks that apply an explicit public access block to the S3 bucket while preserving authenticated IAM access, and to include automated enrichment that queries cloud audit logs for policy change events to context-enrich the incident ticket.
The correct options properly balance rapid automated containment with operational safety and forensic enrichment. Utilizing API webhooks to apply a public access block neutralizes the misconfiguration immediately without invalidating internal IAM roles required by microservices. Simultaneously, automating the retrieval of audit log metadata provides essential context to responders without delaying containment.

Adım Adım Çözüm

1
Evaluate containment mechanisms for object storage exposure.
Identified that applying an explicit public block via API webhooks surgically eliminates internet exposure without disrupting internal IAM-authenticated services.
Containment actions in SOAR playbooks must isolate the threat vector without breaking production dependencies.
2
Assess the role of context enrichment in automated incident workflows.
Determined that gathering recent API audit log trails automatically enriches the ticket with attacker/user context for effective analyst triage.
SOAR platforms excel at aggregating threat intelligence and log metadata before escalating to human responders.
3
Analyze distractor containment and control options for operational risk and technical feasibility.
Rejected bucket deletion due to severe operational damage and rejected host IPS agent installation due to the architectural reality of cloud object storage services.
Automated playbooks must avoid destructive actions on production data assets and must respect cloud platform control boundaries.

Anahtar Kavram

SOAR Playbook Containment Logic and Context Enrichment
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru