Refer to the exhibit. An engineer configured this SOAR solution workflow to identify account theft threats and privilege escalation, evaluate risk, and respond by resolving the threat. This solution…

Excluding 'BAN malicious IP' removes a key automated remediation step and shifts burden to analysts, increasing their workload rather than freeing time for proactive analysis.

Including a 'Take a Snapshot' step preserves the endpoint's memory, processes, and file state at the moment a threat is detected. This allows security analysts to review captured evidence at their own pace, enabling proactive analysis and attack anticipation without requiring real-time intervention during every automated remediation cycle.

Excluding 'Check for GeoIP location' removes an automated enrichment step and forces analysts to perform this lookup manually, which increases rather than reduces their workload.

Adding a 'Reporting' step only notifies the security department of threats already handled; it provides no forensic data for analysts to use in anticipating future attacks.