350-201 Question 255
Select 3A security operations team is deploying a SOAR platform to improve their incident response process. They want to incorporate automation, orchestration, and machine learning to handle repetitive tasks, streamline workflows, and identify patterns in threats. Which of the following capabilities should they prioritize to achieve these goals?
- A
Automated enrichment of alerts with threat intelligence from external sources
- B
Manual case assignment for all security incidents
- C
Orchestrating playbooks to automate multi-step response actions
- D
Using machine learning to detect anomalies in network traffic
- E
Requiring human approval for every automated action
Show answer and explanation
Correct answers: A, C, D
Explanation
To effectively leverage a SOAR platform for automation, orchestration, and machine learning, the focus should be on features that minimize manual effort, streamline workflows, and enhance incident detection and response through advanced analytics. Automating enrichment, orchestrating playbooks, and utilizing machine learning for anomaly detection align with these goals, while manual processes and excessive human intervention contradict the benefits of a SOAR platform.
- A. Correct.
Automated enrichment of alerts with threat intelligence reduces the need for manual research and accelerates the response process, making it a key feature of SOAR platforms.
- B. Incorrect.
Manual case assignment is a time-consuming process that does not align with the goal of automation and would hinder efficiency.
- C. Correct.
Orchestrating playbooks enables multi-step automated responses across various tools and systems, streamlining incident response workflows.
- D. Correct.
Machine learning can analyze large amounts of data to detect patterns and anomalies, helping organizations identify potential threats more efficiently.
- E. Incorrect.
Requiring human approval for every automated action undermines the purpose of automation and slows down response times, making it less suitable in this context.