350-201 Question 237
Single answerYour cybersecurity team has recently deployed a SOAR platform to streamline incident response. During a simulated phishing attack, the platform successfully identified the malicious email, extracted indicators of compromise (IOCs), and automatically blocked the sender's email address across your organization’s email gateway. Which SOAR concept or mechanism best describes this functionality?
- A
Orchestration
- B
Automation
- C
Incident prioritization
- D
Threat intelligence integration
Show answer and explanation
Correct answer: B
Explanation
The described scenario highlights the SOAR platform’s ability to automatically perform tasks such as extracting IOCs and blocking malicious senders without human intervention. This functionality aligns with the concept of 'Automation,' which is a core mechanism of SOAR platforms. While orchestration, threat intelligence integration, and incident prioritization are also important SOAR features, they are not the primary focus in the given scenario.
- A. Incorrect.
Orchestration involves integrating and managing multiple tools and systems to work together in a coordinated way. While SOAR platforms do orchestrate tools, this scenario specifically highlights automatic execution rather than tool coordination.
- B. Correct.
Automation refers to the execution of tasks without manual intervention, which is the key mechanism at play when the SOAR platform blocks the sender and extracts IOCs automatically.
- C. Incorrect.
Incident prioritization focuses on evaluating and ranking incidents based on their severity, which is not the primary action described in this scenario.
- D. Incorrect.
Threat intelligence integration involves incorporating external or internal threat data into the platform for better decision-making. While this might have influenced the detection, it is not the primary mechanism highlighted in this scenario.