An Engineer Implemented a SOAR Workflow to Detect and Respond

question 57

Multiple Choice

An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials. How should the workflow be improved to resolve these issues?

• A) Meet with privileged users to increase awareness and modify the rules for threat tags and anomalous behavior alerts
• B) Change the SOAR configuration flow to remove the automatic remediation that is increasing the false positives and triggering threats
• C) Add a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts
• D) Increase incorrect login tries and tune anomalous user behavior not to affect privileged accounts

---

Definitions:

Utility

The total satisfaction received from consuming a good or service; often used in economic analysis to understand consumer behavior.

Auto Repairs

Refers to the maintenance, servicing, and fixing of cars and other vehicles to ensure their proper functioning.

Gasoline

A liquid fuel made from petroleum and used primarily as fuel in internal combustion engines.

Chemical Weathering

The breakdown of rocks and minerals through chemical reactions with atmospheric agents such as oxygen, water, and acids, leading to the formation of new minerals and soil.