CAS-005: CompTIA SecurityX

By CompTIA · Question Mode

QuestionQ25

Security Operations

A security engineer reviews an after-action report from a previous security breach and notes a long lag time between detection and containment of a compromised account. The engineer suggests using SOAR to address this concern. Which of the following best explains the engineer's goal?

Explanation

SOAR (Security Orchestration, Automation, and Response) reduces detection-to-containment lag by executing runbooks—predefined automated workflows that respond to specific incident types. Rather than requiring manual investigation and approval cycles, runbooks trigger containment actions (disable accounts, isolate hosts, revoke credentials) immediately upon alert. This automation compresses response time from hours to seconds. SOAR does not prevent compromise, enable ML-based correlation, or add reporting capability—its value is automation-driven speed.

Community Discussion

No comments yet. Be the first to start the discussion!