Examkin

Soru

Zorluk: OrtaSecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) team is designing an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle high-fidelity ransomware alerts from Endpoint Detection and Response (EDR) agents. To prevent widespread encryption, the playbook is intended to isolate infected hosts immediately. However, leadership is concerned that automated isolation of critical domain controllers or database servers could cause severe business disruption. Which design modification should the SOC team implement in the SOAR playbook to balance rapid response with operational safety?

  1. Incorporate a conditional decision node that evaluates asset criticality tags before isolation, routing critical servers to a human-in-the-loop (HITL) approval queue while automatically isolating standard endpoints.Cevap
  2. B
    Set the playbook trigger to automatically execute host isolation commands across all alerted systems without evaluating asset attributes or roles.
  3. C
    Modify the SOAR integration parameters to use basic user authentication credentials instead of API authorization tokens when communicating with endpoint agents.
  4. D
    Reclassify automated host isolation as a detective control within the SIEM to record host network telemetry rather than implementing preventive containment commands.

Cevap

Incorporate a conditional decision node that evaluates asset criticality tags before isolation, routing critical servers to a human-in-the-loop (HITL) approval queue while automatically isolating standard endpoints.
The correct response introduces a conditional check within the playbook workflow based on asset tagging. Standard workstations are automatically isolated to stop ransomware spread, whereas high-value critical assets trigger a human-in-the-loop (HITL) notification for manual analyst verification. This logic successfully mitigates enterprise outage risks while maintaining automated response capabilities.

Adım Adım Çözüm

1
Analyze the operational goal and safety constraints of the SOAR playbook.
Identified the need to isolate compromised endpoints quickly while preventing self-inflicted outages on core infrastructure.
Fully automated isolation on non-critical systems mitigates threat spread, but critical infrastructure requires manual validation to maintain business continuity.
2
Evaluate playbook decision logic implementations.
Conditional branching using metadata (asset criticality tags) separates standard workstations from critical servers.
Conditional branching combined with Human-In-The-Loop (HITL) gates ensures targeted automated response without endangering essential services.

Anahtar Kavram

SOAR Playbook Workflow Logic and Human-in-the-Loop (HITL) Controls
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru