200-201 Question 30
Single answerA security operations center (SOC) analyst is tasked with responding to numerous alerts triggered by a specific threat. To improve response efficiency, the SOC team decides to implement run book automation (RBA). Which of the following describes an advantage of using RBA in this scenario?
- A
It ensures all threat alerts are resolved without human intervention.
- B
It standardizes response workflows, reducing manual effort.
- C
It eliminates the need for analysts to monitor alerts in real-time.
- D
It provides a fully automated solution to threat hunting and analysis.
Show answer and explanation
Correct answer: B
Explanation
Run book automation (RBA) is a methodology used to streamline and standardize repetitive incident response tasks by automating predefined workflows. In this scenario, the SOC team benefits from RBA by reducing manual effort and ensuring a consistent approach to handling alerts, which improves overall efficiency. However, RBA does not replace human oversight or cover all aspects of cybersecurity operations entirely.
- A. Incorrect.
This is incorrect because RBA does not guarantee resolution of all alerts without human involvement. Complex cases may still require manual intervention.
- B. Correct.
This is correct because RBA is designed to standardize and automate repetitive response workflows, enabling faster and more consistent incident handling.
- C. Incorrect.
This is incorrect because RBA complements but does not replace real-time monitoring by analysts. Analysts are still required for oversight and decision-making in complex scenarios.
- D. Incorrect.
This is incorrect because RBA focuses on automating specific workflows and tasks, not providing a complete automated solution for all aspects of threat hunting and analysis.