Exam CS0-003 topic 1 question 102 discussion

Correct SOAR (Security Orchestration, Automation, and Response) is a technology that allows organizations to automate and streamline their security processes. It enables security teams to define and automate workflows, including tasks like threat detection, incident response, and remediation.

Last few questions regarding automation and/or minimal human interaction seems to be "SOAR".

The best option to help the analyst implement the recommendation is: A. SOAR (Security Orchestration, Automation, and Response) SOAR platforms are specifically designed to automate security operations, including tasks such as incident response, threat intelligence management, and workflow orchestration. By utilizing a SOAR platform, the analyst can create automated workflows that trigger actions based on events detected by the EDR agent, such as collecting the source IP address of a malicious connection. The SOAR platform can then integrate with the firewall to automatically create and enforce a policy to block the malicious IP address across the entire network. This approach streamlines the incident response process, reduces manual intervention, and improves the organization's overall security posture.