A municipal SOC asks whether technique automation should be detection-as-code triggered or manually queued. Which guidance fits adversary-behavior automation in SOC workflows?
Select an answer to reveal the explanation.
Short Explanation
Think traffic lights versus parade permits. You'll let low-impact regression ride a detection-as-code hook, but you'll keep multi-stage chains in your human queue with change control in the city SOC.
Full Explanation
A municipal SOC deciding between detection-as-code–triggered emulation and manually queued runs should use manual or change-controlled queues for higher-impact chains, and allow detection-as-code hooks only for low-impact regression tests with clear ownership. That guidance balances automation speed with civic safety: higher-impact chains need manual or change-controlled queues, not just manual SOAR-ticketed queues, but low-impact technique checks can regress detections continuously when owned and scoped. Adversary-behavior automation belongs in SOC workflow with risk-tiered triggers.
Why the other options fail by concept: Using manual SOAR-ticketed queues for higher-impact chains, and allowing detection-as-code hooks only for low-impact regression tests with clear ownership narrows the approved control to SOAR ticketing alone, so it drops the broader manual or change-controlled queue guidance and misstates the higher-impact requirement. Using manual or change-controlled queues for higher-impact chains, and allowing SOAR remediation hooks only for low-impact regression tests with clear ownership swaps the low-impact trigger from detection-as-code to remediation, so it wires emulation to response actions instead of detection regression and risks unintended remediation. Using manual or change-controlled queues for higher-impact chains, and allowing detection-as-code hooks only for low-impact model retraining with clear ownership misdirects the hook to model retraining instead of regression tests, so it leaves detections unregressed while automating an out-of-scope ML task.
Exam caveat: “low-impact” must be defined (no encryption, no mass account lockout, approved hosts only); misclassification turns a safe hook into an incident. Operational check: classify each emulation by impact, wire only low-impact regressions to detection-as-code with named owners, require change-controlled queues for higher-impact chains, and audit trigger logs after municipal detection pipeline changes.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.