CIM Automation & Incident Orchestration 3 — Questions and Answers
Question 1: What is the primary risk of over-automating incident response without adequate tuning?
- Reduced storage costs
- High false-positive rates causing alert fatigue and unintended automated actions (Correct answer)
- Slower network throughput
- Increased physical hardware requirements
Correct answer: High false-positive rates causing alert fatigue and unintended automated actions
Poorly tuned automation can act on false positives, triggering unnecessary responses that disrupt services or waste resources, worsening analyst workload.
Question 2: In SOAR-driven incident orchestration, what is the role of a 'connector' or 'integration'?
- A physical cable linking servers
- A software component that enables the SOAR platform to communicate with external tools such as firewalls or SIEMs (Correct answer)
- A reporting module within the SIEM
- A network protocol for alert transport
Correct answer: A software component that enables the SOAR platform to communicate with external tools such as firewalls or SIEMs
Connectors/integrations are adapters that allow SOAR platforms to authenticate and exchange data with third-party security tools through their APIs.
Question 3: Which approach best supports continuous improvement of automated incident playbooks?
- Locking playbooks after initial deployment to prevent changes
- Reviewing playbook execution metrics and post-incident feedback to iteratively refine logic (Correct answer)
- Replacing automation with manual processes quarterly
- Limiting playbook access to senior management
Correct answer: Reviewing playbook execution metrics and post-incident feedback to iteratively refine logic
Regular review of execution metrics and lessons learned from incidents allows teams to identify gaps and optimize playbook logic over time.
Question 4: An automated playbook quarantines an endpoint immediately upon detecting malware. What critical step should the playbook also trigger simultaneously?
- Reboot all servers in the data center
- Notify the endpoint owner and create an incident ticket for analyst follow-up (Correct answer)
- Delete all logs from the endpoint
- Disable all firewall rules
Correct answer: Notify the endpoint owner and create an incident ticket for analyst follow-up
Simultaneous notification and ticket creation ensures analysts are aware of the automated action and can investigate root cause and impact without delay.
Question 5: What distinguishes 'orchestration' from 'automation' in the context of incident response?
- Orchestration only applies to cloud environments while automation is on-premises
- Orchestration coordinates multiple automated tasks and tools across a workflow, while automation refers to individual task execution (Correct answer)
- Automation is manual and orchestration is automatic
- There is no functional difference between the two terms
Correct answer: Orchestration coordinates multiple automated tasks and tools across a workflow, while automation refers to individual task execution
Orchestration manages the sequencing, coordination, and decision logic across multiple automated steps and disparate tools, whereas automation executes a single repeatable task.
Question 6: Why is version control important for incident response playbooks in a SOAR environment?
- It reduces the need for SIEM licenses
- It tracks changes over time, allows rollback to known-good versions, and supports auditability (Correct answer)
- It improves network latency
- It eliminates the need for testing
Correct answer: It tracks changes over time, allows rollback to known-good versions, and supports auditability
Version control provides a history of playbook changes, enables rollback when a new version introduces errors, and satisfies audit requirements for change management.
Question 7: A security team wants to automate phishing email response. Which sequence of playbook steps is most logical?
- Delete email → Report to CISO → Extract IOCs → Block sender
- Extract IOCs → Block sender/URL → Search mailboxes for similar emails → Notify affected users (Correct answer)
- Notify users → Extract IOCs → Block sender → Archive logs
- Archive logs → Notify CISO → Block sender → Extract IOCs
Correct answer: Extract IOCs → Block sender/URL → Search mailboxes for similar emails → Notify affected users
Extracting IOCs first enables all subsequent blocking and hunting steps to be targeted, making the response both systematic and thorough.
CIM Automation & Incident Orchestration 3
What is the primary risk of over-automating incident response without adequate tuning?