CAS-005 · Question #394
A security engineer reviews an after-action report from a previous security breach and notes a long lag time between detection and containment of a compromised account. The engineer suggests using…
The correct answer is D. To prepare runbooks to automate future incident response. SOAR (Security Orchestration, Automation, and Response) platforms help automate and standardize incident response processes through runbooks, reducing response time and improving containment efficiency during future breaches.
Question
A security engineer reviews an after-action report from a previous security breach and notes a long lag time between detection and containment of a compromised account. The engineer suggests using SOAR to address this concern. Which of the following best explains the engineer's goal?
Options
- ATo prevent accounts from being compromised
- BTo enable log correlation using machine learning
- CTo orchestrate additional reporting for the security operations center
- DTo prepare runbooks to automate future incident response
How the community answered
(41 responses)- B5% (2)
- C2% (1)
- D93% (38)
Explanation
SOAR (Security Orchestration, Automation, and Response) platforms help automate and standardize incident response processes through runbooks, reducing response time and improving containment efficiency during future breaches.
Community Discussion
No community discussion yet for this question.