Cisco
350-201 · Question #122
350-201 Question #122: Real Exam Question with Answer & Explanation
The correct answer is C: Check SOAR to learn what the security systems are reporting about the overnight events,. When investigating a complex multi-vector incident, SOAR platforms provide the fastest comprehensive overview by automatically aggregating and correlating data from all security tools in a single view.
Processes
Question
A SOC engineer discovers that the organization had three DDOS attacks overnight. Four servers are reported offline, even though the hardware seems to be working as expected. One of the offline servers is affecting the pay system reporting times. Three employees, including executive management, have reported ransomware on their laptops. Which steps help the engineer understand a comprehensive overview of the incident?
Options
- ARun and evaluate a full packet capture on the workloads, review SIEM logs, and define a root
- BRun and evaluate a full packet capture on the workloads, review SIEM logs, and plan mitigation
- CCheck SOAR to learn what the security systems are reporting about the overnight events,
- DCheck SOAR to know what the security systems are reporting about the overnight events, review
Explanation
When investigating a complex multi-vector incident, SOAR platforms provide the fastest comprehensive overview by automatically aggregating and correlating data from all security tools in a single view.
Common mistakes.
- A. Running full packet captures and reviewing SIEM logs are valuable but slow manual steps that cover only partial data sources, and defining a root cause is premature before the full incident scope is understood.
- B. Planning mitigation before achieving comprehensive situational awareness through correlated multi-source data is premature and risks addressing symptoms rather than the full attack chain.
- D. This option also references SOAR but likely adds follow-on steps that are not appropriate for the initial comprehensive overview phase of incident response.
Concept tested. SOAR platform use for multi-vector incident overview
Reference. https://www.cisco.com/c/en/us/products/security/what-is-soar.html
Topics
#SOAR#SIEM#incident triage#DDoS
Community Discussion
No community discussion yet for this question.