nerdexam
Cisco

350-201 · Question #122

A SOC engineer discovers that the organization had three DDOS attacks overnight. Four servers are reported offline, even though the hardware seems to be working as expected. One of the offline…

The correct answer is C. Check SOAR to learn what the security systems are reporting about the overnight events. When investigating a complex multi-vector incident, SOAR platforms provide the fastest comprehensive overview by automatically aggregating and correlating data from all security tools in a single view.

Processes

Question

A SOC engineer discovers that the organization had three DDOS attacks overnight. Four servers are reported offline, even though the hardware seems to be working as expected. One of the offline servers is affecting the pay system reporting times. Three employees, including executive management, have reported ransomware on their laptops. Which steps help the engineer understand a comprehensive overview of the incident?

Options

  • ARun and evaluate a full packet capture on the workloads, review SIEM logs, and define a root
  • BRun and evaluate a full packet capture on the workloads, review SIEM logs, and plan mitigation
  • CCheck SOAR to learn what the security systems are reporting about the overnight events,
  • DCheck SOAR to know what the security systems are reporting about the overnight events, review

How the community answered

(31 responses)
  • A
    10% (3)
  • B
    3% (1)
  • C
    84% (26)
  • D
    3% (1)

Why each option

When investigating a complex multi-vector incident, SOAR platforms provide the fastest comprehensive overview by automatically aggregating and correlating data from all security tools in a single view.

ARun and evaluate a full packet capture on the workloads, review SIEM logs, and define a root

Running full packet captures and reviewing SIEM logs are valuable but slow manual steps that cover only partial data sources, and defining a root cause is premature before the full incident scope is understood.

BRun and evaluate a full packet capture on the workloads, review SIEM logs, and plan mitigation

Planning mitigation before achieving comprehensive situational awareness through correlated multi-source data is premature and risks addressing symptoms rather than the full attack chain.

CCheck SOAR to learn what the security systems are reporting about the overnight events,Correct

SOAR (Security Orchestration, Automation and Response) centralizes and correlates alerts from EDR, SIEM, firewall, and email security systems simultaneously, providing a unified picture of the entire incident scope covering DDoS, offline servers, and ransomware. This automated aggregation is the most efficient first step for gaining comprehensive situational awareness before moving to root cause analysis or mitigation planning.

DCheck SOAR to know what the security systems are reporting about the overnight events, review

This option also references SOAR but likely adds follow-on steps that are not appropriate for the initial comprehensive overview phase of incident response.

Concept tested: SOAR platform use for multi-vector incident overview

Source: https://www.cisco.com/c/en/us/products/security/what-is-soar.html

Topics

#SOAR#SIEM#incident triage#DDoS

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 350-201 Practice