350-201 Question 134
Select 4A security operations team has detected a suspicious file being downloaded by multiple users in the organization. The team wants to automate the response to minimize the impact and escalate to the appropriate personnel if the issue persists. Which of the following recommended actions align with procedural and SOAR workflows for this scenario?
- A
Automate the isolation of affected endpoints using SOAR playbooks.
- B
Send an email notification to all employees in the company warning them of the threat.
- C
Trigger an automated file analysis in a sandbox environment via SOAR.
- D
Automatically update the firewall rules to block the file's source URL.
- E
Escalate the incident to the threat intelligence team if malicious behavior is confirmed.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
The appropriate procedural and SOAR workflows in this scenario involve automating containment and analysis actions (e.g., isolating endpoints, sandbox analysis, and updating firewall rules) while ensuring escalation paths are followed for confirmed malicious activity. Sending a company-wide email is not part of a structured SOAR workflow and is not a recommended practice for handling such incidents.
- A. Correct.
SOAR can automate the isolation of affected endpoints to prevent the threat from spreading, making this a valid procedural and SOAR workflow action.
- B. Incorrect.
Sending a company-wide email is not a recommended procedural or SOAR workflow for this case, as it may cause unnecessary panic and is not a targeted response.
- C. Correct.
Initiating an automated sandbox analysis to determine the behavior of the suspicious file is a relevant SOAR workflow action.
- D. Correct.
Automatically updating firewall rules to block the source URL of the malicious file is an appropriate automated response to reduce further exposure.
- E. Correct.
Escalating the incident to the threat intelligence team ensures proper analysis and mitigation if the file is confirmed as malicious, aligning with procedural workflows.