CySA+ SOAR Playbook Automation for IR Quiz

1. When integrating a SOAR platform with a SIEM, what should be automated first?

Alert enrichment and correlation

Executive reporting

Vendor invoicing

User training materials

2. True or False: SOAR playbooks can improve compliance reporting by automating evidence collection and documentation.

True

False

3. In a ransomware incident playbook, the first automated action should isolate ____.

Infected systems

Backup servers

Network routers

Cloud storage

4. What does it mean when a SOAR playbook has a 'failure path' defined?

Actions to take if automated steps do not succeed

Documentation of past security breaches

A list of deprecated security tools

Incident response team roster

5. When designing a playbook for credential compromise, which integration is essential?

Directory services and identity management systems

Email marketing platforms

Social media APIs

Vendor patch management portals

6. True or False: SOAR playbooks should be tested in a production environment before deployment.

True

False

7. Which playbook component stores the current state of an incident during automated response?

Trigger

Action

Context or case management system

Alert threshold

8. What is the primary challenge when implementing SOAR playbook automation across multiple organizations?

Different security tool vendors and configurations

Too many analysts available

Excess automation budget

Lack of security alerts

9. In an automated response playbook for DDoS incidents, which action should NOT be automated without approval?

Logging and alerting

Blocking entire network segments

Collecting flow data

Notifying the SOC team

10. True or False: SOAR playbooks can only execute actions within the SOAR platform itself.

True

False

11. What is the primary benefit of SOAR playbook automation in incident response?

Eliminates the need for security analysts

Reduces response time and human error through automated workflows

Replaces all manual security controls

Increases the number of alerts generated

12. What is the purpose of conditional logic in a SOAR playbook?

To randomly select actions

To route incidents based on severity or other criteria

To duplicate all alerts

To disable security controls

13. Which metric best measures SOAR playbook automation effectiveness?

Number of playbooks created

Mean time to detect and mean time to respond

Total alerts generated

Number of analysts employed

14. True or False: SOAR playbooks eliminate the need for human oversight in incident response.

True

False

15. In a malware incident playbook, what should happen immediately after file quarantine?

Send user notification and log the action

Delete the file permanently

Continue normal operations

Wait for manual analyst review before any action

16. Which of the following best describes a SOAR orchestration workflow?

A single automated script run once daily

A coordinated sequence of actions across multiple security tools

Manual documentation of incident steps

A backup system for failed alerts

17. What is a trigger in a SOAR playbook context?

A manual command executed by analysts

An event or condition that initiates automated actions

A firewall rule blocking traffic

An alert severity level

18. When designing a playbook for phishing incident response, which step should occur first?

Isolate user endpoints

Automatically detect and extract indicators

Send notification to management

Archive email messages

19. A SOAR platform must integrate with multiple security tools. Which integration type is most critical for real-time threat response?

API-based integration

Email notifications

Manual log review

Weekly reports

20. Which phase of incident response is most enhanced by SOAR playbook automation?

Preparation and detection

Containment and eradication

Post-incident activities

All phases equally

CySA+ SOAR Playbook Automation for IR Quiz

1. When integrating a SOAR platform with a SIEM, what should be automated first?

2.

What first name or nickname would you like us to use?

2. True or False: SOAR playbooks can improve compliance reporting by automating evidence collection and documentation.

3. In a ransomware incident playbook, the first automated action should isolate ____.

4. What does it mean when a SOAR playbook has a 'failure path' defined?

5. When designing a playbook for credential compromise, which integration is essential?

6. True or False: SOAR playbooks should be tested in a production environment before deployment.

7. Which playbook component stores the current state of an incident during automated response?

8. What is the primary challenge when implementing SOAR playbook automation across multiple organizations?

9. In an automated response playbook for DDoS incidents, which action should NOT be automated without approval?

10. True or False: SOAR playbooks can only execute actions within the SOAR platform itself.

11. What is the primary benefit of SOAR playbook automation in incident response?

12. What is the purpose of conditional logic in a SOAR playbook?

13. Which metric best measures SOAR playbook automation effectiveness?

14. True or False: SOAR playbooks eliminate the need for human oversight in incident response.

15. In a malware incident playbook, what should happen immediately after file quarantine?

16. Which of the following best describes a SOAR orchestration workflow?

17. What is a trigger in a SOAR playbook context?

18. When designing a playbook for phishing incident response, which step should occur first?

19. A SOAR platform must integrate with multiple security tools. Which integration type is most critical for real-time threat response?

20. Which phase of incident response is most enhanced by SOAR playbook automation?