CISSP Security Operations Practice Question
An organization's security operations center (SOC) uses a SIEM to correlate logs. The SOC manager wants to automate response actions for low-severity alerts. Which technology would best support this goal?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SOAR platform
SOAR (Security Orchestration, Automation and Response) enables automated playbooks for incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network firewall
Why it's wrong here
A network firewall primarily enforces access control policies by filtering network traffic based on predefined rules, such as IP address, port, or protocol. While critical for perimeter defense and blocking known malicious traffic, firewalls are reactive in their rule enforcement and lack the capability to ingest security alerts from various sources, analyze them, and orchestrate automated responses like isolating a compromised host or enriching incident data. Their function is traffic control, not comprehensive incident response automation.
- ✗
Threat intelligence platform
Why it's wrong here
A Threat Intelligence Platform (TIP) aggregates, processes, and disseminates information about current and emerging threats, including indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs). While invaluable for enriching security alerts and providing context for manual analysis and proactive defense, a TIP's core function is data correlation and dissemination, not the automated execution of response actions. It informs decision-making and enhances threat awareness but does not directly automate the remediation or containment steps of an incident.
- ✓
SOAR platform
Why this is correct
A Security Orchestration, Automation, and Response (SOAR) platform integrates various security tools and systems to automate and orchestrate incident response workflows. It ingests alerts from SIEMs and other sources, applies predefined playbooks to analyze incidents, and automatically executes actions such as blocking IP addresses, isolating endpoints, enriching data, or creating tickets. This capability significantly reduces manual effort, accelerates response times, and standardizes incident handling procedures within a SOC by automating repetitive tasks.
- ✗
Vulnerability scanner
Why it's wrong here
A vulnerability scanner systematically identifies security weaknesses and misconfigurations in systems, applications, and networks by comparing them against a database of known vulnerabilities. Its primary purpose is to discover potential attack vectors and provide reports for remediation planning, thereby improving an organization's proactive security posture. While essential for identifying weaknesses, a vulnerability scanner does not possess the functionality to automatically respond to real-time security incidents or orchestrate defensive actions once an attack is underway.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security operations center
A Security Operations Center (SOC) is a centralized team and facility that monitors, detects, analyzes, and responds to cybersecurity incidents across an organization's IT environment 24/7.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.