312-39V2: Certified SOC Analyst v2

Question

A Security Operations Center (SOC) analyst receives a high-priority alert for unusual user activity. An employee account is attempting to access company resources from another country and outside its normal working hours. This behavior raises concerns about possible account compromise or unauthorized access. To automate the initial response and rapidly restrict access while the incident is further investigated, which SOAR Playbook would be relevant to adapt and implement?

Explanation

Potential account compromise requires prompt identity containment, such as disabling the account or revoking its access, while the investigation proceeds. A Deprovisioning Users SOAR Playbook is the relevant starting point because it can be adapted to perform that access restriction automatically. Microsoft Sentinel documents automated threat-response playbooks that can block a compromised account.

Learn more

Automate threat response with playbooks in Microsoft Sentinel

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ18

Community Discussion