CompTIA Security+ (SY0-701)Security OperationsHard
A security engineer is configuring a network device to block traffic from known malicious IP addresses and domains. The device needs to automatically update its block list based on a continuously fed stream of threat intelligence indicators. Which security technology is most suitable for this requirement?
- AData Loss Prevention (DLP)
- BIntrusion Detection System (IDS)
- CSecurity Information and Event Management (SIEM)
- DSecurity Orchestration, Automation, and Response (SOAR)
Show answer & explanationAnswer & explanation
Correct answer: D. Security Orchestration, Automation, and Response (SOAR)
Security Orchestration, Automation, and Response (SOAR) platforms are designed to automate and orchestrate security operations tasks, including integrating with threat intelligence feeds to automatically update security devices (like firewalls or network devices) with new block lists. While a firewall performs the blocking, SOAR enables the *automatic updating* based on intelligence feeds.
Why the other options are wrong
- A. DLP focuses on preventing sensitive data exfiltration, not on blocking malicious network traffic based on threat intelligence.
- B. An IDS detects suspicious activity but typically does not automatically update blocking rules on other network devices; an IPS (Intrusion Prevention System) could block, but SOAR provides the automation for dynamic updates from intelligence feeds.
- C. SIEM aggregates and correlates security logs but does not directly automate the configuration of network devices based on threat intelligence feeds.
Security Orchestration, Automation, and Response (SOAR)
A platform that enables organizations to collect threat-related data, orchestrate and automate security workflows, and respond to incidents more efficiently.
- Automates repetitive security tasks.
- Integrates various security tools and threat intelligence feeds.
- Facilitates rapid incident response and threat mitigation.
Memory trick: SOAR: Orchestrate, Automate, Respond – like a security conductor.