CCP SOAR Playbook Development 2

Question 1

During SOAR playbook development, what is the primary purpose of defining 'triggers' at the start of a playbook?

Accepted Answer

To specify the conditions or events that initiate playbook execution

Answer

Triggers define the specific conditions, alerts, or events that automatically invoke a playbook, ensuring consistent and timely response.

Question 2

A SOAR playbook for ransomware response includes a step to isolate an endpoint. Which integration type is most commonly used to perform this action automatically?

Accepted Answer

EDR or endpoint management platform API

Answer

EDR platforms expose APIs that SOAR tools use to quarantine or isolate endpoints without manual intervention during ransomware incidents.

Question 3

What does a 'decision node' in a SOAR playbook represent?

Accepted Answer

A branching point where playbook flow changes based on a condition

Answer

Decision nodes evaluate conditions (e.g., severity score, asset criticality) and route the playbook down different execution paths accordingly.

Question 4

When building a phishing playbook, which enrichment action adds the most contextual value to a suspicious URL before escalation?

Accepted Answer

Checking the URL against a threat intelligence reputation feed

Answer

Querying reputation feeds provides categorization, maliciousness scores, and historical context that inform whether the URL warrants escalation.

Question 5

Which SOAR playbook design principle reduces alert fatigue by limiting analyst interruptions to truly critical decisions?

Accepted Answer

Automating low-risk, high-confidence actions and reserving human-in-the-loop steps for ambiguous situations

Answer

Automating routine, high-confidence actions while flagging only uncertain or high-risk decisions for human review balances speed with oversight.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP SOAR Playbook Development 2