Security Orchestration Automation and Response

GASAE · 20 questions

• A city SOC designs a phishing SOAR playbook that detonates the URL, checks intel, notifies the user, and resets credentials if needed. What design practice is that?
• A county requires human approval before any SOAR step that disables Entra accounts for judges. What playbook design control is that?
• A transit authority splits SOAR playbooks into enrichment-only and containment modules for reuse. What design approach is that?
• A school district encodes error handling when the sandbox API is down mid-playbook. What resilience practice is that?
• A housing SOC versions SOAR playbooks and can roll back after a bad auto-reset wave. What release practice is that?
• A city integrates EDR, email gateway, CMDB, and ITSM into one SOAR case. What integration pattern is that?
• A county uses independent webhooks so losing the ticketing connector does not stop enrichment. What integration design is that?
• A public-health team maps least-privilege API keys per SOAR integration. What connector security practice is that?
• A parks department prefers read-only SOAR integrations first, then write actions after metrics prove value. What privilege approach is that?
• A library consortium documents every SOAR action that can modify production mailboxes. What integration governance practice is that?
• A city evaluates low-code SOAR versus custom Python workers for high-volume phishing. What platform decision is that?
• A county fusion center needs SOAR stories that can be exported for mutual-aid partners. What platform pattern is that?
• A transit SOC standardizes case schemas so different SOAR tools still feed one metrics lake. What platform pattern is that?
• An emergency-management agency uses SOAR to fan-out notifications to on-call and public-info officers. What orchestration pattern is that?
• A court IT team rejects SOAR vendors that cannot run in their sovereign cloud region. What platform selection constraint is that?
• A city SOC wants a SOAR success metric that reflects analyst minutes saved on each phishing case. Which measurement approach best supports that municipal efficiency goal?
• A county enables auto-isolate playbooks and wants to know whether containment is safe as well as fast. Which metric best captures that SOAR effectiveness concern?
• A 311 security desk has thin overnight staffing and still must meet alert SLAs. How should SOAR be used to address that coverage gap?
• A water utility holds weekly SOAR case reviews to remove noisy playbook branches that waste analyst time. What continuous-improvement practice is that?
• A city CISO must brief council on SOAR adoption across the highest-volume municipal alert types. Which reporting approach best supports that executive update?