Question

A SOC manager is reviewing analyst workloads to identify which task should be automated first. The team handles four recurring activities daily. Which characteristics make a task the BEST candidate for automation in a security operations workflow?

Accepted Answer

A high-volume, repetitive task with well-defined, rule-based decision logic and consistent input data

Answer

A low-frequency task that requires human judgment, contextual analysis, and stakeholder negotiation

Answer

A task performed once per quarter that involves interpreting ambiguous executive requirements

Answer

A creative threat-hunting activity that relies on analyst intuition and exploratory hypothesis testing