Examkin

Soru

Zorluk: OrtaSecurity Automation and Orchestration (SOAR)

A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle initial triage and containment for incoming high-severity suspicious email alerts. Which of the following tasks represent safe, effective automated steps to include in the initial playbook execution prior to analyst review? (Select TWO.)

  1. Query external threat intelligence APIs to verify the reputation scores of URLs and attachment hashes found in the message.Cevap
  2. Issue API calls to the email gateway to quarantine the matching message across all internal employee mailboxes.Cevap
  3. C
    Trigger an automated script to isolate primary network domain controllers if their IP addresses appear in the email headers.
  4. D
    Automatically disable the Active Directory user accounts of all recipients immediately upon alert ingestion.

Cevap

The correct response steps are to query external threat intelligence APIs for domain and hash reputation and to quarantine the email message across internal mailboxes using email gateway API integrations.
Automated SOAR playbooks perform best when executing rapid enrichment (such as querying threat intelligence feeds for malicious domain reputation) and targeted, low-risk containment (such as quarantining an email message across mailboxes via API). These steps neutralize immediate exposure while providing rich contextual data for analyst decision-making.

Adım Adım Çözüm

1
Evaluate automated threat enrichment capabilities
Automated threat intelligence queries enrich indicators without impacting business operations.
Enriching alerts with external domain and file hash reputation provides context required for analyst triage.
2
Evaluate low-risk automated containment actions
Quarantining emails at the mail gateway prevents further user interaction.
Removing suspicious messages from recipient mailboxes stops potential phishing execution while preserving system availability.
3
Identify high-risk distractor logic in automated playbooks
Isolating critical infrastructure or locking out recipients causes immediate business disruption.
Executing destructive actions automatically on unverified or low-fidelity indicators creates self-inflicted denial of service.

Anahtar Kavram

SOAR Playbook Design and Low-Risk Automated Response
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru