Your SOC uses an AI-based SOAR system to automate incident response.
Nopal Securities technical mcq question, verified with a worked answer. Free to practise - no sign-up.
Your SOC uses an AI-based SOAR system to automate incident response. The system has received multiple alerts about brute-force login attempts from different IPs. Which automated action should be configured in the SOAR system to mitigate this threat effectively?
Show answer & explanation
SOAR playbooks automate containment by programmatically pushing block rules to network firewalls and updating case tickets/reports.
Step-by-step Derivation:
Step 1: In response to verified brute-force alarms, automated SOAR playbooks contain threats.
Step 2: Pushing firewall drop rules blocks the attacking IPs immediately.
Step 3: Automated incident reports document the containment actions for analysts.