CySA+ SOAR Playbook Automation for IR Quiz

1. Which type of incident typically requires manual override of automated SOAR responses?

High-severity, novel, or policy-sensitive incidents

All automated responses should never be overridden

Only incidents occurring on weekends

Incidents involving the CEO's email

2. Which element is critical for ensuring accountability in automated incident response?

Audit logging of all automated actions and decisions

Removing logs to hide incidents

Disabling user access controls

Eliminating management oversight

3. In SOAR platforms, what does workflow templating allow security teams to do?

Reuse standardized response procedures across similar incidents

Eliminate the need for incident response plans

Prevent all security incidents

Bypass compliance requirements

4. What is the primary benefit of automated evidence collection in incident response?

Preserves forensic integrity and ensures consistent documentation

Eliminates the need for legal review

Allows deletion of evidence after collection

Reduces the need for incident investigations

5. Which stakeholder group should be involved in incident response playbook development?

Security, IT, legal, management, and business units

Only the IT department

Only executive leadership

Only external vendors

6. In incident response, what is the significance of automated alert deduplication?

Reduces alert fatigue and prevents duplicate investigation efforts

Increases the number of alerts sent to analysts

Eliminates the need for monitoring

Disables all security alerts

7. What role does orchestration play in SOAR-based incident response?

Coordinates actions across multiple security tools in a defined sequence

Plays background music during incidents

Schedules team lunch breaks

Manages office supplies

8. Which of the following is a best practice for maintaining incident response playbooks?

Regular testing, updates, and validation against new threats

Creating playbooks once and never modifying them

Keeping playbooks secret from the security team

Using identical playbooks for all incident types

9. In SOAR automation, what does API integration enable?

Seamless communication between security tools and automated workflows

Direct access to executive email accounts

Bypassing authentication controls

Deleting security alerts

10. What is the purpose of incident severity classification in SOAR playbooks?

Determines response urgency and resource allocation

Decides which department pays for the incident

Identifies which vendor to blame

Determines employee bonuses

11. What is the primary purpose of SOAR platform integration in incident response?

Automate repetitive tasks and accelerate response times

Replace all human analysts with automated systems

Reduce the need for threat intelligence feeds

Eliminate the requirement for incident documentation

12. What should be included in post-incident automation workflows?

Evidence collection, reporting, and lessons learned documentation

Deleting all incident logs

Terminating all system access

Disabling security tools

13. In CySA+ v4, which metric measures the effectiveness of automated incident response?

Mean time to detect (MTTD) and mean time to respond (MTTR)

Number of emails sent daily

Total storage capacity in gigabytes

Employee attendance records

14. What is a key advantage of using conditional logic in incident response playbooks?

Routes incidents to appropriate teams based on severity and type

Eliminates the need for incident logs

Prevents all security incidents

Reduces the need for firewalls

15. Which tool integration is essential for SOAR platforms to perform automated threat hunting?

SIEM and endpoint detection and response (EDR) systems

Email client software

Web browsers

Video conferencing platforms

16. In incident response, what does containment automation typically involve?

Isolating affected systems and blocking malicious IP addresses

Sending emails to all users

Updating social media status

Scheduling team meetings

17. What is the role of threat intelligence in SOAR playbook execution?

Enriches alerts with context for better decision-making

Determines employee vacation schedules

Selects which vendors to purchase from

Controls network bandwidth allocation

18. Which of the following is a critical component of an effective incident response playbook?

Clear escalation procedures and decision trees

Marketing team approval steps

Vendor product endorsements

Executive social media notifications

19. In CySA+ v4, what does playbook automation primarily help reduce?

Mean time to respond (MTTR)

Total network bandwidth usage

Compliance audit costs

Security awareness training needs

20. Which phase of incident response benefits most from SOAR playbook automation?

Detection and analysis

Containment and eradication

Post-incident activity only

Preparation exclusively