CCP SOAR Playbook Development 3

Question 1

A SOC team wants to build a playbook for credential stuffing attacks. Which data source should be the PRIMARY trigger for this playbook?

Accepted Answer

Multiple failed login attempts followed by a successful login from an unusual geography

Answer

The pattern of repeated authentication failures followed by a suspicious successful login is a hallmark indicator of credential stuffing activity.

Question 2

Which SOAR concept describes a reusable, modular unit of automation that can be called by multiple playbooks?

Accepted Answer

Sub-playbook or playbook block

Answer

Sub-playbooks encapsulate repeatable logic (e.g., IP enrichment, user deactivation) that can be invoked by many parent playbooks, reducing duplication.

Question 3

During playbook testing, a security engineer discovers that an automated block action fires on internal IP addresses. What playbook control prevents this?

Accepted Answer

A pre-action allowlist or whitelist check that excludes RFC 1918 and trusted internal ranges

Answer

Allowlist checks before destructive actions ensure automation does not accidentally disrupt internal infrastructure or trusted assets.

Question 4

What is the role of 'SLA timers' within a SOAR playbook for incident response?

Accepted Answer

To track response time against required targets and escalate if thresholds are exceeded

Answer

SLA timers enforce response-time commitments by escalating unresolved incidents to senior staff or management when deadlines approach.

Question 5

A playbook designed for data exfiltration detection should include which containment action as a high-priority automated step?

Accepted Answer

Blocking the destination IP or domain at the firewall or proxy layer

Answer

Blocking the exfiltration destination at network controls is the most immediate containment action to stop active data loss.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP SOAR Playbook Development 3