SkillTestPro | CCNP Security 300-745 SDSI Practice Test 19

CCNP Security 300-745 SDSI Practice Test 19 (Hard) - SOC Incident Response Tools and Technologies

CISCO CCNP Security Exam Logo

1 / 10

Which tool category aggregates log and event data from across an organization's environment into a centralized platform to support detection, correlation, and investigation?

A calendar scheduling application with no relationship to log aggregation or correlation

A cafeteria payment processing system with no relationship to security events

A standalone endpoint antivirus agent with no centralized log aggregation capability

Security information and event management (SIEM)

A printer management console with no relationship to security event correlation

A physical badge access reader with no relationship to log aggregation

2 / 10

Which tool category is most specifically designed to automate and orchestrate repetitive incident response actions (such as automatically isolating a compromised endpoint) across multiple integrated security tools?

Security orchestration, automation, and response (SOAR)

A standalone spreadsheet application with no integration to any security tool

A building HVAC control system with no relationship to security tool orchestration

A parking garage management system with no relationship to incident response

A company holiday calendar with no relationship to security orchestration

A physical fire suppression system with no relationship to incident response automation

3 / 10

Which capability does endpoint detection and response (EDR) tooling provide that most directly supports a SOC analyst investigating a suspected endpoint compromise?

A printer usage report with no relationship to endpoint compromise investigation

A billing report tracking only the organization's software licensing costs with no endpoint telemetry, regardless of the platform version in use, which is rarely the correct choice, based on standard platform behavior

A cafeteria menu system with no relationship to endpoint telemetry

A physical inventory list of endpoint hardware serial numbers with no behavioral telemetry

Detailed endpoint-level telemetry (such as process execution history and file system changes) combined with remote investigation and response actions like process termination or endpoint isolation

A company holiday calendar with no relationship to endpoint investigation

4 / 10

Which risk would most likely result from a SOC adopting a SOAR platform to automate incident response actions without carefully validating and testing the automated playbooks before production use?

Adopting SOAR automation without testing would automatically reduce the SOC's overall tooling costs to zero

Adopting SOAR automation without testing would automatically improve the accuracy of every automated action taken, under typical configuration conditions, which does not align with best practices, which is not the standard approach

Adopting SOAR automation without validation would have no operational risk whatsoever compared to manual response

An automated playbook could take an incorrect or overly broad action (such as isolating the wrong system or a critical production server) in response to a false positive, causing unintended business disruption

The organization's DNS infrastructure would automatically fail as a direct result of adopting SOAR automation

SOAR automation would automatically validate its own playbooks with no testing required by the organization

5 / 10

Which factor would most influence how much autonomous action a SOC allows a SOAR playbook to take without requiring analyst approval (such as fully automated blocking versus a recommended action awaiting analyst confirmation)?

The confidence level and false-positive rate associated with the triggering detection, combined with the potential business impact if the automated action is taken incorrectly

The color scheme configured for the SOAR platform's playbook editor

The specific brand of coffee served in the security operations center

The number of parking spaces available at the organization's headquarters, based on standard platform behavior, which is inconsistent with expected behavior, under normal operating conditions

The font used in the organization's internal newsletter

The average outdoor temperature at the organization's headquarters

6 / 10

Which combination of SOC tooling would provide comprehensive detection, investigation, and response capability for a large enterprise?

A SIEM deployed with no accompanying EDR or SOAR capability, relying solely on log data with no endpoint telemetry or automation, in accordance with common design practices, which is not the standard approach

SOAR playbooks deployed directly into full autonomous production use with no prior testing or validation

EDR deployed with no centralized SIEM correlation, leaving endpoint telemetry siloed from other event sources

A SIEM for centralized log aggregation and correlation, EDR for detailed endpoint telemetry and response actions, and a SOAR platform for automating and orchestrating validated, tested response playbooks

SIEM, EDR, and SOAR capabilities deployed but never integrated with each other in any way

A SOAR platform automating response actions with no underlying SIEM or EDR data to inform its playbook decisions

7 / 10

Which troubleshooting step would be appropriate if a SOC's SOAR platform fails to automatically isolate a compromised endpoint as expected, despite the triggering EDR alert being correctly generated?

Assume the issue is unrelated to integration configuration and only check the SOC's physical office temperature, which is not the standard approach, under typical configuration conditions, under normal operating conditions

Immediately disable the SOAR platform entirely as the first troubleshooting step with no further investigation

Review the SOAR playbook's integration configuration with the EDR platform to confirm the automated isolation action's API call, credentials, or trigger conditions are correctly configured and were not silently failing

Assume the issue is caused by the SOC analysts' choice of desktop wallpaper

Assume the issue is caused by the phase of the moon

Assume SOAR-to-EDR integration is a deprecated capability no longer supported by any platform

8 / 10

Which statement accurately describes why SIEM, EDR, and SOAR are generally considered complementary tools rather than redundant capabilities within a SOC's toolset?

An organization must choose exactly one of SIEM, EDR, or SOAR and can never deploy more than one together

SIEM provides centralized correlation across broad log sources, EDR provides deep endpoint-specific telemetry and response, and SOAR automates the response workflow across both, so each addresses a different layer of the detection-to-response lifecycle

SOAR alone already fully replaces the need for both SIEM and EDR in any SOC toolset

SIEM alone already fully replaces the need for both EDR and SOAR in any SOC toolset

EDR alone already fully replaces the need for both SIEM and SOAR in any SOC toolset

SIEM, EDR, and SOAR are simply three different names for the exact same identical tool category with no distinction, under normal operating conditions, which is rarely the correct choice, which is inconsistent with expected behavior, which is inconsistent with expected behavior

9 / 10

Which combination of practices would help a SOC maintain effective incident response tooling as its environment and the threat landscape evolve over time?

Reviewing tooling effectiveness only once per year regardless of how frequently the environment or threat landscape changes

Assuming new systems deployed into the environment will automatically be covered by existing SIEM log source configuration with no review

Periodically reviewing and expanding SIEM log source coverage as new systems are deployed, validating and updating SOAR playbooks against current threat techniques, and regularly testing EDR response actions to confirm they still function as expected

Disabling periodic tooling review entirely once the SOC believes its incident response capability is mature enough to not need it

Testing SOAR playbooks and EDR response actions only once, at the time of initial deployment, with no ongoing validation

Configuring SIEM log sources, SOAR playbooks, and EDR response actions once at initial deployment and never revisiting them regardless of environmental change, in accordance with common design practices, which is not the standard approach, under normal operating conditions

10 / 10

Which design consideration is most important when integrating threat intelligence feeds into a SOC's SIEM and SOAR tooling to support detection and automated response?

Assuming all threat intelligence feeds are equally accurate and require no validation of any kind

Requiring manual review of every single threat intelligence indicator before it can ever be ingested into any tool

Assuming threat intelligence indicators never become outdated or irrelevant once ingested into the platform

Disabling threat intelligence ingestion entirely since it is assumed to provide no value to detection or response

Validating the quality, relevance, and timeliness of the threat intelligence source, since low-quality or irrelevant indicators could generate excessive false positives or trigger inappropriate automated actions

Ingesting every available threat intelligence feed indiscriminately with no evaluation of source quality or relevance, based on standard platform behavior, which is inconsistent with expected behavior, which does not align with best practices

Your score is

The average score is 0%