CCP SOAR Playbook Development 3 — Questions and Answers
Question 1: A SOC team wants to build a playbook for credential stuffing attacks. Which data source should be the PRIMARY trigger for this playbook?
- Firewall rule change alerts
- Multiple failed login attempts followed by a successful login from an unusual geography (Correct answer)
- Antivirus quarantine notifications
- DNS sinkhole traffic logs
Correct answer: Multiple failed login attempts followed by a successful login from an unusual geography
The pattern of repeated authentication failures followed by a suspicious successful login is a hallmark indicator of credential stuffing activity.
Question 2: Which SOAR concept describes a reusable, modular unit of automation that can be called by multiple playbooks?
- Runbook
- Sub-playbook or playbook block (Correct answer)
- Incident template
- Case management rule
Correct answer: Sub-playbook or playbook block
Sub-playbooks encapsulate repeatable logic (e.g., IP enrichment, user deactivation) that can be invoked by many parent playbooks, reducing duplication.
Question 3: During playbook testing, a security engineer discovers that an automated block action fires on internal IP addresses. What playbook control prevents this?
- Running playbooks only in business hours
- A pre-action allowlist or whitelist check that excludes RFC 1918 and trusted internal ranges (Correct answer)
- Requiring dual-analyst approval for all block actions
- Disabling the block action entirely
Correct answer: A pre-action allowlist or whitelist check that excludes RFC 1918 and trusted internal ranges
Allowlist checks before destructive actions ensure automation does not accidentally disrupt internal infrastructure or trusted assets.
Question 4: What is the role of 'SLA timers' within a SOAR playbook for incident response?
- To schedule recurring vulnerability scans
- To track response time against required targets and escalate if thresholds are exceeded (Correct answer)
- To measure network latency between SOAR components
- To auto-close incidents after a fixed period regardless of status
Correct answer: To track response time against required targets and escalate if thresholds are exceeded
SLA timers enforce response-time commitments by escalating unresolved incidents to senior staff or management when deadlines approach.
Question 5: A playbook designed for data exfiltration detection should include which containment action as a high-priority automated step?
- Sending a courtesy notification to the affected user
- Blocking the destination IP or domain at the firewall or proxy layer (Correct answer)
- Archiving relevant logs to long-term storage only
- Generating a post-incident report
Correct answer: Blocking the destination IP or domain at the firewall or proxy layer
Blocking the exfiltration destination at network controls is the most immediate containment action to stop active data loss.
Question 6: Which metric best measures the operational effectiveness of a SOAR playbook over time?
- Number of playbooks deployed
- Mean Time to Respond (MTTR) and the percentage of incidents handled without analyst intervention (Correct answer)
- Total lines of playbook logic written
- Number of integrations connected to the SOAR platform
Correct answer: Mean Time to Respond (MTTR) and the percentage of incidents handled without analyst intervention
MTTR reduction and automation rate directly reflect whether playbooks are speeding response and reducing manual workload as intended.
Question 7: When documenting a SOAR playbook for compliance purposes, which element is MOST important to include for audit trails?
- The names of vendors whose products are integrated
- Timestamped logs of every automated and manual action taken during playbook execution (Correct answer)
- Marketing descriptions of SOAR platform capabilities
- Network topology diagrams of the SOC infrastructure
Correct answer: Timestamped logs of every automated and manual action taken during playbook execution
Detailed, timestamped action logs provide the evidence auditors need to verify that incident response followed documented procedures.
CCP SOAR Playbook Development 3
A SOC team wants to build a playbook for credential stuffing attacks.
Which data source should be the PRIMARY trigger for this playbook?