nerdexam
Cisco

350-201(NEW-127Q) · Question #101

A SOC team receives multiple alerts from a rule that detects requests to malicious URLs. The rule also informs the incident response team to block the malicious URLs requested on the firewall…

The correct answer is D. Integrate the SOC team's SOAR platform with the firewall to automate the process of blocking malicious URLs. Option D is correct because SOAR (Security Orchestration, Automation and Response) platforms are built specifically to bridge detection and response by automating remediation actions. Integrating the SOAR platform with the firewall means malicious URLs are blocked…

Incident Management and Response

Question

A SOC team receives multiple alerts from a rule that detects requests to malicious URLs. The rule also informs the incident response team to block the malicious URLs requested on the firewall. However, the incident response team is often overwhelmed with alerts and may not be able to block the malicious URLs in a timely manner. The organization has a policy that requires that all malicious URLs be blocked within 1 minute of being detected. Which action should a SOC team recommend to improve the effectiveness of the process?

Options

  • ACreate an automation script that sends an automated email to the incident response team with a list of all malicious URLs that have been detected.
  • BImplement a new rule that blocks all requests to malicious URLs, regardless of whether the incident response team has been notified.
  • CImplement a new rule that blocks all requests to malicious URLs, but only for users who have been previously flagged by the incident response team.
  • DIntegrate the SOC team's SOAR platform with the firewall to automate the process of blocking malicious URLs.

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    14% (3)
  • D
    77% (17)

Explanation

Option D is correct because SOAR (Security Orchestration, Automation and Response) platforms are built specifically to bridge detection and response by automating remediation actions. Integrating the SOAR platform with the firewall means malicious URLs are blocked programmatically the instant they're detected - satisfying the 1-minute policy without depending on an overwhelmed human team.

Why the distractors fail:

  • A still relies on human action - an automated email doesn't block anything, it just shifts the bottleneck from alerts to an inbox.
  • B is tempting but vague; a static firewall rule blocking "all requests regardless of notification" doesn't dynamically respond to newly detected malicious URLs fed from the detection system.
  • C introduces an arbitrary restriction (previously flagged users only) that would leave most users unprotected and contradicts the organization's blanket policy.

Memory tip: Whenever an exam scenario describes a time-sensitive response gap between detection and human action, the answer almost always involves SOAR automation. Think: "If humans can't respond fast enough, automate the handoff between the alert and the firewall."

Topics

#SOAR Automation#Incident Response#Threat Blocking#SOC Operations

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 350-201(NEW-127Q) Practice