An organization is updating a SOAR playbook to mitigate compromised API access keys linked to high-availability microservices. To prevent accidental operational outages on mission-critical services while maintaining rapid incident containment and enrichment, which TWO of the following playbook configurations should be implemented?
- Incorporate a human-in-the-loop manual approval step before executing automated account or access suspension against critical production infrastructure.Cevap
- BConfigure the playbook to automatically trigger full network segment isolation on core identity servers immediately upon receiving a single unverified anomaly alert.
- Execute temporary API session token revocation while simultaneously querying threat intelligence connectors for context enrichment.Cevap
- DReclassify automated SOAR containment scripts as detective administrative controls to bypass technical authorization checks during execution.
Cevap
The playbook should require human-in-the-loop approval before suspending critical production assets and perform targeted API session token revocation paired with threat intelligence enrichment.
Integrating a human-in-the-loop authorization gate before modifying critical production assets prevents automated outages. Concurrently, revoking active API session tokens and gathering threat intelligence achieves rapid, focused containment while preserving surrounding microservice availability.
Adım Adım Çözüm
Anahtar Kavram
SOAR Playbook Logic, Operational Risk Mitigation, and Targeted Response
Tahmini Süre:2m 0s