PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #100
You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions: - Send an email to users who do not have a Google S
The correct answer is D. Generate an approval link for the containment action and include the placeholder in the body of. The correct approach is to generate an approval link for the containment action and embed it in the email sent via the Gmail integration. When the user clicks the link (approve/deny), the playbook automatically resumes execution and follows the logic for approved or denied outcom
Question
You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions:
- Send an email to users who do not have a Google Security Operations (SecOps) account to
request approval for endpoint containment
- Automatically continue executing its logic after the user responds
You plan to implement this process in the playbook by using the Gmail integration. You want to minimize the amount of effort required by the SOC analyst. What should you do?
Options
- ASet the containment action to 'Manual' and assign the action to the user to execute or skip the
- BSet the containment action to 'Manual' and assign the action to the appropriate tier. Contact the
- CUse the 'Send Email' action to send an email requesting approval to contain the endpoint, and
- DGenerate an approval link for the containment action and include the placeholder in the body of
How the community answered
(33 responses)- A3% (1)
- B3% (1)
- C9% (3)
- D85% (28)
Explanation
The correct approach is to generate an approval link for the containment action and embed it in the email sent via the Gmail integration. When the user clicks the link (approve/deny), the playbook automatically resumes execution and follows the logic for approved or denied outcomes. This ensures: - The process is automated and requires minimal SOC analyst effort. - Users without SecOps accounts can still approve actions securely through email. - The playbook continues automatically based on the response, instead of waiting for a manual analyst decision.
Topics
Community Discussion
No community discussion yet for this question.