CIM Automation & Incident Orchestration 4

Question 1

What is 'alert deduplication' in automated incident management?

Accepted Answer

Grouping or suppressing repeated alerts about the same event to reduce noise and prevent duplicate tickets

Answer

Alert deduplication consolidates repeated alerts about the same underlying event, reducing noise and preventing analysts from working multiple tickets for a single incident.

Question 2

In incident orchestration, what is the purpose of a 'dead letter queue'?

Accepted Answer

Capturing automation tasks or messages that fail to process so they can be reviewed and retried

Answer

A dead letter queue holds failed automation messages or tasks so they are not lost and can be investigated, retried, or manually handled.

Question 3

A SOAR playbook must decide whether to auto-close an alert or escalate it. Which factor should most influence this decision logic?

Accepted Answer

A confidence score based on enrichment data such as threat intel reputation and asset criticality

Answer

Combining threat intelligence reputation and asset criticality into a confidence score gives the playbook objective, data-driven criteria for routing decisions.

Question 4

What is 'runbook automation' and how does it differ from a full SOAR playbook?

Accepted Answer

Runbook automation executes predefined IT operational procedures step-by-step, while SOAR playbooks coordinate cross-tool security workflows with decision logic

Answer

Runbook automation focuses on standardized IT operational steps, whereas SOAR playbooks integrate multiple security tools, apply conditional logic, and manage the full incident lifecycle.

Question 5

Which of the following best describes 'bi-directional integration' between a ticketing system and a SOAR platform?

Accepted Answer

Changes in either system—SOAR or the ticketing tool—are synchronized with the other in real time

Answer

Bi-directional integration ensures that status updates, comments, or field changes in either system are reflected in the other, keeping records consistent.

(CIM) Certified Incident Manager Practice Test

(CIM) Certified Incident Manager Practice Test

CIM Automation & Incident Orchestration 4