An organization plans to implement an incident response strategy that includes orchestration and automation. The security team must understand the key differences between these concepts, platforms…

Question

Options

• AAutomation focuses on the manual coordination of incident response activities, and orchestration uses machine learning algorithms for decision-making.
• BAutomation involves streamlining manual tasks, and orchestration is the automated coordination and management of the incident response process.
• COrchestration refers to the use of a single security platform, and automation involves integrating multiple security tools for a unified response.
• DOrchestration involves the integration of multiple security tools, and automation is the process of developing custom scripts for incident response.

• A
  3% (2)
• B
  87% (55)
• C
  8% (5)
• D
  2% (1)

Explanation

Option B correctly captures the distinction: automation handles the streamlining or execution of individual, repetitive tasks (e.g., automatically blocking an IP, sending an alert), while orchestration is the higher-level coordination that ties multiple automated tasks and tools together into a coherent, managed workflow across the incident response lifecycle.

Why the distractors fail:

• A is backwards and wrong - automation is not manual, and orchestration doesn't inherently use ML.
• C reverses the definitions - orchestration is about integrating multiple tools, not a single platform; that description better fits a SIEM or unified dashboard.
• D gets orchestration partially right (multi-tool integration) but misdefines automation - writing custom scripts is a development activity, not what automation means operationally.

Memory tip: Think of it like a kitchen - automation is each appliance doing its job automatically (the dishwasher, the oven timer), while orchestration is the chef coordinating all those appliances in the right sequence to produce a meal. Automation = individual tasks; Orchestration = the bigger workflow that connects them.

No community discussion yet for this question.