200-201 Question 29
Select 3A Security Operations Center (SOC) analyst is investigating an alert for potential malware activity. The SOC has implemented a run book automation (RBA) system to assist with incident response. Which of the following actions would be most appropriate for the RBA system to perform in this scenario?
- A
Automatically isolate the affected host from the network based on predefined rules.
- B
Send an automated email to all employees warning them about the potential malware.
- C
Retrieve and analyze logs from the affected system and generate a report.
- D
Terminate the suspicious process on the affected host without analyst intervention.
- E
Create an incident ticket in the organization's tracking system and notify the SOC team.
Show answer and explanation
Correct answers: A, C, E
Explanation
Run book automation (RBA) is used to automate repetitive and predefined tasks in incident response workflows, allowing SOC analysts to focus on higher-priority activities. In this scenario, actions such as isolating a host, retrieving logs, and creating an incident ticket align with RBA's capabilities. However, tasks like sending mass emails or terminating processes without validation are not typically automated due to the risk of false positives and potential disruptions.
- A. Correct.
Correct: RBA systems are designed to perform predefined actions such as isolating a host based on rules to limit the spread of malware.
- B. Incorrect.
Incorrect: While communication is important, sending an automated email to all employees without validation could lead to unnecessary alarm and is not a typical RBA function.
- C. Correct.
Correct: Retrieving and analyzing logs is a standard automated task for RBA to support investigation efforts.
- D. Incorrect.
Incorrect: Terminating processes without analyst intervention can lead to unintended consequences and is generally avoided unless explicitly approved.
- E. Correct.
Correct: Creating an incident ticket and notifying the SOC team is a common RBA task to ensure proper tracking and escalation of incidents.