An analyst proposes a SOAR playbook that automatically deletes any cloud resource associated with a high-severity alert, with no human review, to minimize response time. What is the most appropriate design for the playbook?
Select an answer to reveal the explanation.
Short Explanation
You'd let a robot lock the doors when an alarm trips, but you'd want a person to sign off before it bulldozes the building. SOAR should automate fast, reversible containment and hand the irreversible stuff to a human. The trap is thinking automation means automating everything.
Full Explanation
Security orchestration, automation and response platforms connect detection, enrichment and response tools so routine steps run consistently and quickly through playbooks. Good playbook design matches automation to the risk of each action. Reversible containment steps, such as isolating a workload in a quarantine security group, disabling a credential, snapshotting a volume for evidence or blocking an address, can run automatically because they limit damage and can be undone if the alert proves false. Destructive or irreversible actions, such as deleting resources, require human approval, because false positives are common and deletion destroys both service and forensic evidence. Approving full automation of every action assumes alerts are always correct and turns every false positive into an outage and an evidence loss. Rejecting automation entirely throws away the speed and consistency SOAR provides and leaves analysts overwhelmed by volume. Restricting the destructive playbook to off-hours does not change the risk of acting on false positives; it only changes when the damage occurs and who is around to notice. Exam caveat: the 2026 outline adds SOAR under AI and ML, alongside threat detection, emphasizing appropriate scope for automation. Operational check: review each playbook action, classify it as reversible or destructive, and confirm destructive actions have an approval step and an audit trail.