CIM Automation & Incident Orchestration 2

Question 1

Which orchestration concept ensures that automated incident workflows execute steps in a defined sequence while handling branching logic for different outcomes?

Accepted Answer

Conditional routing

Answer

Conditional routing allows orchestration workflows to branch based on specific conditions or outcomes, enabling dynamic, scenario-driven incident response.

Question 2

A SOAR platform receives 500 low-severity alerts per hour. What is the primary benefit of using automated triage for these alerts?

Accepted Answer

Reduce mean time to acknowledge by auto-closing or escalating without manual review

Answer

Automated triage reduces MTTA by programmatically evaluating and acting on low-severity alerts without requiring manual analyst intervention.

Question 3

What is an 'enrichment playbook' in incident orchestration?

Accepted Answer

An automated workflow that appends contextual data (e.g., threat intel, asset info) to an incident

Answer

An enrichment playbook automatically gathers and attaches relevant context—such as threat intelligence or asset ownership—to an incident record to aid analyst decision-making.

Question 4

In automated incident orchestration, what does 'idempotency' mean?

Accepted Answer

Executing the same automation action multiple times without causing unintended duplicate effects

Answer

Idempotency ensures that re-running an automation step (e.g., due to retry logic) produces the same result as running it once, preventing duplicate tickets or redundant actions.

Question 5

Which metric best reflects the efficiency of an automated incident containment playbook?

Accepted Answer

Mean Time to Contain (MTTC) before and after automation

Answer

MTTC directly measures how quickly incidents are contained, making it the most relevant metric for evaluating automated containment effectiveness.

(CIM) Certified Incident Manager Practice Test

(CIM) Certified Incident Manager Practice Test

CIM Automation & Incident Orchestration 2