CIM Automation & Incident Orchestration 4 — Questions and Answers
Question 1: What is 'alert deduplication' in automated incident management?
- Creating duplicate alerts for redundancy
- Grouping or suppressing repeated alerts about the same event to reduce noise and prevent duplicate tickets (Correct answer)
- Sending alerts to multiple teams simultaneously
- Archiving old alerts automatically
Correct answer: Grouping or suppressing repeated alerts about the same event to reduce noise and prevent duplicate tickets
Alert deduplication consolidates repeated alerts about the same underlying event, reducing noise and preventing analysts from working multiple tickets for a single incident.
Question 2: In incident orchestration, what is the purpose of a 'dead letter queue'?
- Storing resolved incident records permanently
- Capturing automation tasks or messages that fail to process so they can be reviewed and retried (Correct answer)
- Routing low-priority alerts to junior analysts
- Archiving threat intelligence feeds
Correct answer: Capturing automation tasks or messages that fail to process so they can be reviewed and retried
A dead letter queue holds failed automation messages or tasks so they are not lost and can be investigated, retried, or manually handled.
Question 3: A SOAR playbook must decide whether to auto-close an alert or escalate it. Which factor should most influence this decision logic?
- The time of day the alert fired
- A confidence score based on enrichment data such as threat intel reputation and asset criticality (Correct answer)
- The alphabetical order of the alert name
- The color assigned to the severity label
Correct answer: A confidence score based on enrichment data such as threat intel reputation and asset criticality
Combining threat intelligence reputation and asset criticality into a confidence score gives the playbook objective, data-driven criteria for routing decisions.
Question 4: What is 'runbook automation' and how does it differ from a full SOAR playbook?
- Runbook automation replaces SOAR entirely
- Runbook automation executes predefined IT operational procedures step-by-step, while SOAR playbooks coordinate cross-tool security workflows with decision logic (Correct answer)
- They are identical in function and scope
- Runbook automation only applies to hardware provisioning
Correct answer: Runbook automation executes predefined IT operational procedures step-by-step, while SOAR playbooks coordinate cross-tool security workflows with decision logic
Runbook automation focuses on standardized IT operational steps, whereas SOAR playbooks integrate multiple security tools, apply conditional logic, and manage the full incident lifecycle.
Question 5: Which of the following best describes 'bi-directional integration' between a ticketing system and a SOAR platform?
- The ticketing system only sends alerts to SOAR
- Changes in either system—SOAR or the ticketing tool—are synchronized with the other in real time (Correct answer)
- SOAR sends reports to the ticketing system daily
- Integration only functions during business hours
Correct answer: Changes in either system—SOAR or the ticketing tool—are synchronized with the other in real time
Bi-directional integration ensures that status updates, comments, or field changes in either system are reflected in the other, keeping records consistent.
Question 6: When automating the response to a ransomware incident, what action should the playbook prioritize FIRST?
- Paying the ransom automatically
- Isolating affected hosts from the network to prevent lateral movement (Correct answer)
- Sending a public notification to customers
- Restoring all backups immediately
Correct answer: Isolating affected hosts from the network to prevent lateral movement
Immediate network isolation of affected hosts is the top priority to prevent ransomware from spreading to additional systems before any recovery steps begin.
Question 7: What is the significance of 'time-to-live' (TTL) values when automating threat intelligence indicator blocking in firewall rules?
- TTL controls how fast packets travel across the network
- TTL ensures that auto-added block rules expire after a set period, preventing stale rules from permanently blocking legitimate traffic (Correct answer)
- TTL determines the severity score of the indicator
- TTL sets the alert threshold for the SIEM
Correct answer: TTL ensures that auto-added block rules expire after a set period, preventing stale rules from permanently blocking legitimate traffic
Setting a TTL on automatically added firewall block rules ensures they are removed after a defined period, reducing the risk of obsolete rules blocking legitimate traffic indefinitely.
CIM Automation & Incident Orchestration 4
What is 'alert deduplication' in automated incident management?