An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle.
The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually.
Which action will improve workflow automation?

• A. Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.
• B. Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.
• C. Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.
• D. Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.

A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?

• A. Review the server backup and identify server content and data criticality to assess the intrusion risk
• B. Perform behavioral analysis of the processes on an isolated workstation and perform cleaning procedures if the file is malicious
• C. Identify the server owner through the CMDB and contact the owner to determine if these were planned and identifiable activities
• D. Isolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack

An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

• A. Update the IDS/IPS signatures and reimage the affected hosts
• B. Identify the traffic with data capture using Wireshark and review email filters
• C. Host a discovery meeting and define configuration and policy updates
• D. Identify the systems that have been affected and tools used to detect the attack

Refer to the exhibit.

An engineer configured this SOAR solution workflow to identify account theft threats and privilege escalation, evaluate risk, and respond by resolving the threat. This solution is handling more threats than Security analysts have time to analyze. Without this analysis, the team cannot be proactive and anticipate attacks. Which action will accomplish this goal?

• A. Include a step "Take a Snapshot" to capture the endpoint state to contain the threat for analysis
• B. Exclude the step "BAN malicious IP" to allow analysts to conduct and track the remediation
• C. Include a step "Reporting" to alert the security department of threats identified by the SOAR reporting engine
• D. Exclude the step "Check for GeoIP location" to allow analysts to analyze the location and the associated risk based on asset criticality

Refer to the exhibit.

An engineer is performing static analysis of a file received and reported by a user. Which risk is indicated in this STIX?

• A. The file is redirecting users to the website that is downloading ransomware to encrypt files.
• B. The file is redirecting users to a website that requests privilege escalations from the user.
• C. The file is redirecting users to a website that harvests cookies and stored account information.
• D. The file is redirecting users to a website that is determining users' geographic location.