CCP SOAR Playbook Development 4

Question 1

A SOAR playbook for insider threat detection needs to correlate data from multiple sources. Which combination best supports this use case?

Accepted Answer

DLP alerts, user behavior analytics (UBA), HR termination feeds, and access logs

Answer

Insider threat detection requires correlating behavioral anomalies, data movement events, access patterns, and organizational context like HR status.

Question 2

What is the significance of defining 'playbook scope' before development begins?

Accepted Answer

It establishes what incident types, assets, and environments the playbook covers, preventing scope creep and misapplication

Answer

Clearly defined scope ensures the playbook is applied to the right incidents and prevents it from being triggered in contexts where it is inappropriate.

Question 3

Which approach best reduces the risk of a SOAR playbook taking destructive action on a production system due to a false positive?

Accepted Answer

Implementing confidence thresholds so high-impact actions require a minimum severity or corroboration score

Answer

Confidence thresholds ensure destructive actions are only triggered when evidence meets a minimum bar, reducing false-positive-driven disruptions.

Question 4

In a SOAR playbook for vulnerability management, what action bridges the gap between detection and remediation teams?

Accepted Answer

Automatically creating prioritized remediation tickets in the ITSM system with CVE details and asset context

Answer

Auto-generating contextualized ITSM tickets routes actionable remediation tasks to the right teams while maintaining change management processes.

Question 5

A playbook is triggered 500 times per day for low-severity alerts. What technique optimizes SOAR resource use in this scenario?

Accepted Answer

Implementing alert aggregation or deduplication to group related events before playbook execution

Answer

Aggregating or deduplicating related low-severity alerts reduces playbook execution frequency, conserving resources while maintaining coverage.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP SOAR Playbook Development 4