Examkin

Soru

Zorluk: ZorSecurity Automation and Orchestration (SOAR)

A Security Operations Center (SOC) is designing a high-velocity Security Orchestration, Automation, and Response (SOAR) playbook to automatically mitigate risks when an active cloud API access key is detected in a public repository leak. To maintain service availability while ensuring rapid threat containment and contextual enrichment, which of the following response actions should be executed as automated steps without requiring manual human approval? (Select TWO.)

  1. Deactivating the specific exposed API access key via automated integration calls to the Cloud Service Provider management APICevap
  2. Querying threat intelligence API endpoints to append risk scores and context for originating IP addresses directly into the incident ticketCevap
  3. C
    Triggering an automated hard power-down of all production virtual machine instances associated with the cloud tenant
  4. D
    Modifying application security group role permissions to perform identity verification of the API caller

Cevap

The correct response actions are deactivating the specific exposed API access key via Cloud Service Provider API integration and querying threat intelligence API endpoints to append risk context to the incident ticket.
Deactivating the specific exposed API key directly addresses the compromised secret at the management plane without causing unintended outages to compute resources. Querying threat intelligence sources to enrich incident tickets is a standard automated SOAR practice that increases analyst velocity without operational risk.

Adım Adım Çözüm

1
Evaluate containment actions for operational risk vs. threat mitigation
Deactivating the compromised API key via CSP integration neutralizes the vector immediately without shutting down host servers or network workloads.
Targeted credential disabling isolates the attack vector safely without risking collateral downtime.
2
Identify non-disruptive enrichment tasks suitable for full automation
Automating threat intelligence lookups and appending IP reputation scores to the alert ticket provides SOC analysts with instant context.
Enrichment activities carry zero risk of operational disruption and dramatically reduce mean time to respond (MTTR).
3
Analyze distractor actions for operational logic errors and control category confusion
Hard rebooting production instances causes unacceptable outages. Modifying authorization roles confuses permission assignment with authentication verification.
Automated playbooks must avoid disruptive system-wide containment actions without human-in-the-loop approval.

Anahtar Kavram

SOAR Playbook Automated Actions vs. Human-in-the-Loop Safeguards
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru