CCP SOAR Playbook Development 5

Question 1

A CCP candidate is reviewing a playbook that handles compromised service accounts. Which automated remediation step carries the highest risk if executed without human review?

Accepted Answer

Disabling the service account, potentially breaking dependent applications or services

Answer

Disabling a service account can immediately break production services that depend on it, making human review essential before this action is automated.

Question 2

What is the purpose of a 'playbook kill switch' in SOAR operations?

Accepted Answer

To immediately pause or disable a running playbook if it is causing unintended damage or false positive actions

Answer

A kill switch provides operators a rapid way to halt a misbehaving playbook during an incident without waiting for a full platform change cycle.

Question 3

During post-incident review, the team finds a SOAR playbook missed a key containment step for a lateral movement incident. What process should follow?

Accepted Answer

Conducting a lessons-learned review and updating the playbook logic to cover the missed scenario

Answer

Post-incident reviews translate gaps discovered in real incidents into playbook improvements, iteratively maturing the SOC's automated response capabilities.

Question 4

Which threat intelligence standard is most commonly used to enrich SOAR playbook actions with structured indicator data?

Accepted Answer

STIX/TAXII (Structured Threat Information eXpression / Trusted Automated eXchange)

Answer

STIX defines the schema for threat intelligence objects (IOCs, TTPs) while TAXII provides the transport protocol, making them the standard for sharing threat intel with SOAR tools.

Question 5

A playbook for cloud account compromise should include which cloud-specific automated action as an early containment step?

Accepted Answer

Revoking or rotating compromised IAM credentials and attaching a deny-all policy to the affected principal

Answer

Revoking or rotating IAM credentials and applying a deny-all policy immediately cuts off the attacker's access vector without destroying forensic evidence.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP SOAR Playbook Development 5