CCP SOAR Playbook Development 2 — Questions and Answers
Question 1: During SOAR playbook development, what is the primary purpose of defining 'triggers' at the start of a playbook?
- To log all security events to a SIEM
- To specify the conditions or events that initiate playbook execution (Correct answer)
- To assign analyst roles for incident response
- To generate compliance reports automatically
Correct answer: To specify the conditions or events that initiate playbook execution
Triggers define the specific conditions, alerts, or events that automatically invoke a playbook, ensuring consistent and timely response.
Question 2: A SOAR playbook for ransomware response includes a step to isolate an endpoint. Which integration type is most commonly used to perform this action automatically?
- SIEM log forwarder
- EDR or endpoint management platform API (Correct answer)
- Threat intelligence feed connector
- Email gateway integration
Correct answer: EDR or endpoint management platform API
EDR platforms expose APIs that SOAR tools use to quarantine or isolate endpoints without manual intervention during ransomware incidents.
Question 3: What does a 'decision node' in a SOAR playbook represent?
- A mandatory human approval step
- A branching point where playbook flow changes based on a condition (Correct answer)
- A final action that closes an incident
- A scheduled task that runs periodically
Correct answer: A branching point where playbook flow changes based on a condition
Decision nodes evaluate conditions (e.g., severity score, asset criticality) and route the playbook down different execution paths accordingly.
Question 4: When building a phishing playbook, which enrichment action adds the most contextual value to a suspicious URL before escalation?
- Checking the URL against a threat intelligence reputation feed (Correct answer)
- Resetting the affected user's password immediately
- Archiving the phishing email to cold storage
- Blocking all outbound traffic from the mail server
Correct answer: Checking the URL against a threat intelligence reputation feed
Querying reputation feeds provides categorization, maliciousness scores, and historical context that inform whether the URL warrants escalation.
Question 5: Which SOAR playbook design principle reduces alert fatigue by limiting analyst interruptions to truly critical decisions?
- Requiring analyst approval for every playbook action
- Automating low-risk, high-confidence actions and reserving human-in-the-loop steps for ambiguous situations (Correct answer)
- Routing all alerts to a single senior analyst
- Disabling notifications for low-severity incidents
Correct answer: Automating low-risk, high-confidence actions and reserving human-in-the-loop steps for ambiguous situations
Automating routine, high-confidence actions while flagging only uncertain or high-risk decisions for human review balances speed with oversight.
Question 6: A playbook action fails because an API key for an integrated threat intel platform has expired. What playbook design feature best handles this scenario?
- A hard-coded fallback API key in the playbook script
- Error handling logic that alerts the SOC team and gracefully degrades to a manual step (Correct answer)
- Automatically deleting the incident ticket
- Retrying the failed action indefinitely
Correct answer: Error handling logic that alerts the SOC team and gracefully degrades to a manual step
Robust error handling notifies operators of integration failures and falls back to manual processes, preventing silent failures during active incidents.
Question 7: In the context of SOAR playbook lifecycle management, what does 'playbook versioning' primarily enable?
- Automatic deployment to all SOAR instances simultaneously
- Tracking changes over time, rolling back to stable versions, and auditing modifications (Correct answer)
- Encrypting playbook logic to protect intellectual property
- Converting playbooks into training documentation
Correct answer: Tracking changes over time, rolling back to stable versions, and auditing modifications
Versioning records playbook changes, who made them, and when, enabling rollback if a new version introduces errors and supporting audit requirements.
CCP SOAR Playbook Development 2
During SOAR playbook development, what is the primary purpose of defining 'triggers' at the start of a playbook?