SY0-701 Question 377
Single answer4.7 Explain the importance of automation and orchestration related to secure operations.A security operations center (SOC) is overwhelmed by repeated phishing alerts from the email gateway. Analysts currently review each alert manually, check the sender reputation, search endpoint telemetry for related indicators, disable affected accounts, and block confirmed malicious domains on the secure web gateway. Management wants to reduce response time and analyst workload without removing human oversight for high-impact actions. Which solution would BEST address this requirement?
- A
Implement a SOAR platform that automatically enriches phishing alerts with threat intelligence and endpoint data, then routes high-confidence cases for analyst approval before disabling accounts or blocking domains
- B
Increase the email gateway sensitivity so it quarantines all suspicious messages automatically and remove the SOC from the phishing response process
- C
Configure full-disk encryption on analyst workstations so phishing investigations can be performed more securely
- D
Require analysts to use a more detailed manual checklist for phishing triage to ensure consistent handling of each alert
Show answer and explanation
Correct answer: A
Explanation
The best answer is the SOAR-based approach because the topic focuses on the importance of automation and orchestration in secure operations. Automation handles repetitive tasks such as alert enrichment, indicator lookups, and evidence gathering. Orchestration coordinates actions across multiple security technologies and operational systems, such as email security tools, EDR platforms, identity providers, and web gateways. In real SOC operations, this improves mean time to detect (MTTD) and mean time to respond (MTTR), reduces analyst fatigue, and helps standardize playbook-driven responses. At the same time, retaining analyst approval for high-impact actions follows best practices by balancing efficiency with change control and reducing the risk of false-positive-driven disruptions. This aligns with common guidance from NIST incident response practices and industry use of SOAR platforms to automate low-risk tasks while preserving human decision-making for sensitive containment actions.
- A. Correct.
Correct. This is the best example of automation and orchestration supporting secure operations. A SOAR solution can automate repetitive enrichment tasks, such as querying threat intelligence and endpoint tools, while orchestrating actions across multiple systems like email security, identity management, and web filtering. Requiring analyst approval for disruptive actions preserves human oversight and reduces the risk of unintended account lockouts or overblocking.
- B. Incorrect.
Incorrect. Increasing sensitivity may reduce some manual effort, but quarantining all suspicious messages and removing analysts from the process can create operational disruption and false positives. This does not address coordinated workflows across tools, and it eliminates the requested human oversight for high-impact actions.
- C. Incorrect.
Incorrect. Full-disk encryption is valuable for protecting data at rest, but it does not improve phishing alert triage, response orchestration, or cross-platform automation. This option addresses endpoint confidentiality rather than SOC workflow efficiency.
- D. Incorrect.
Incorrect. A more detailed manual checklist may improve consistency, but it does not reduce response time in the same way automation and orchestration do. The scenario specifically calls for reducing analyst workload and accelerating response while keeping oversight, which manual processes do not accomplish effectively at scale.