Automation

A SOC engineer is integrating a threat intelligence platform with an internal script. The vendor documentation shows that each request must include an 'Authorization' header containing a shared identifier plus a computed hash of the request body, timestamp, and a secret key that is never transmitted over the wire. Which authentication mechanism does this describe?

A SOC engineer is writing a Python integration against a threat intelligence vendor's REST API. The vendor documentation states that each request must include the header 'X-API-Key: <value>' and that no username or password is transmitted. The engineer's colleague suggests using Python's requests library with the auth=(user, pass) parameter instead. Which statement correctly describes the authentication mechanism required and why the colleague's approach is inappropriate?

A SOC engineer writes a script that submits a list of 5,000 suspicious file hashes to a threat intelligence REST API in a single POST request. The API repeatedly returns HTTP 413 responses, and the script fails. The API documentation states that each request body may not exceed 100 hashes. What is the MOST appropriate modification to the script to resolve this issue?

A SOC engineer writes a Python script that queries a threat-intelligence API to enrich indicators. For a batch of 500 IOCs the request consistently fails after about 30 seconds, even though smaller batches succeed. The API documentation states responses are returned synchronously and connections are dropped if a single request exceeds a fixed server-side processing limit. Which API constraint is the engineer most likely encountering, and what is the best remediation?

A SOC analyst is writing a Bash script that calls a threat intelligence REST API. The API key must be available to a Python script launched from the same shell session, but the analyst does not want the key hard-coded in either file or visible in the script's source. Which Bash command correctly makes the key available to the child Python process?

During an investigation, a SOC analyst needs to identify all files larger than 100 MB inside the /var/log directory tree so they can archive and clear excessive log data that is filling a disk. Which Bash command correctly accomplishes this?

A SOC analyst is triaging a Linux authentication log at /var/log/auth.log during an incident. They need to quickly produce a count of how many distinct source IP addresses generated 'Failed password' entries. Which single Bash command pipeline accomplishes this most directly?

During incident response, an analyst must relocate 40 suspicious log files from /var/log/incoming/ into a quarantine directory at /secure/quarantine/ on the same Linux host. The chain-of-custody procedure requires that the files' original modification timestamps and content remain unchanged, and the source directory must be empty afterward. Which single Bash command best accomplishes this?

A SOC engineer writes a Python client that queries a threat-intelligence REST API for indicators matching a submitted hash. When the engineer submits a hash that the platform does not track, the API returns an HTTP status of 200 with a body of '[]' (an empty JSON array). The engineer's script currently treats any 200 response as 'indicator found and enriched' and creates a case. What is the correct interpretation of this response, and what should the script do?

A SOC engineer writes a Python script to pull alerts from a threat intelligence REST API. Instead of the expected JSON alert data, the script receives an HTTP 302 status code with a 'Location' header pointing to a login portal, and the body contains HTML. What is the MOST likely cause and correct interpretation of this response?

A SOC engineer writes a Python script that pulls indicators from a threat intelligence REST API using an API key passed in the request header. The script worked yesterday, but today every request returns HTTP 401 with a body message of {"error":"invalid or expired credentials"}. The endpoint URL and payload are unchanged. What is the MOST likely cause the engineer should investigate first?

A SOC engineer writes a script that submits indicators to an internal threat-intelligence REST API. The same request that worked yesterday now returns an HTTP 500 status code, while requests to other endpoints on the same server succeed and the engineer's token is still valid. What does the 500 response indicate the engineer should do?

A SOC engineer writes a Python script that submits a suspicious file hash to a threat intelligence platform's REST API using a POST request to create a new watchlist entry. The API returns a status code of 201 along with a Location header. What does this response indicate the engineer should do next?

A SOC analyst writes a script that queries a threat intelligence platform's REST API using the endpoint /api/v2/indicators/{id}. For most indicator IDs the script works correctly, but for one specific ID the server consistently returns an HTTP 404 response with a JSON body of {"error": "resource not found"}. The analyst has confirmed the API token is valid and other endpoints respond normally. What is the MOST likely cause of the 404 response?

A SOC analyst is writing a parser for threat feed data. When inspecting one feed's payload, they observe records structured with angle-bracket element tags, nested child elements, and metadata expressed as name="value" pairs inside the opening tags. Which data format is this feed using?

A SOC analyst writes a Python script to consume a threat intelligence REST API. The script sends a GET request and receives a response with status code 200. When the script tries to call response.json() to parse the body, it raises a JSONDecodeError even though the request succeeded. Inspecting the raw response, the analyst sees the following header: Content-Type: application/xml. Which conclusion best explains the failure?

A SOC analyst receives the following API response body while integrating a threat intelligence feed into a SOAR playbook: { "indicators": [ { "value": "198.51.100.5", "type": "ipv4", "confidence": 85 }, { "value": "evil.example.com", "type": "domain", "confidence": 60 } ], "count": 2 } Based on the structure of this data, which statement most accurately describes the format so the analyst can select the correct parsing approach in the playbook?

A SOC manager is reviewing analyst workloads to identify which task should be automated first. The team handles four recurring activities daily. Which characteristics make a task the BEST candidate for automation in a security operations workflow?

A SOC manager is evaluating a new SOAR platform. One analyst argues that a single Python script that pulls IOCs from a threat feed and writes them to a firewall blocklist already gives the team 'orchestration.' The manager wants to correct this misunderstanding by explaining the core distinction between automation and orchestration. Which statement most accurately describes that distinction?

A SOC analyst is reviewing a provided Python snippet that processes alerts pulled from a SIEM API. The variable 'alerts' is a list of dictionaries, each containing the keys 'id', 'severity', and 'source_ip'. The analyst runs the following line: critical = [a['source_ip'] for a in alerts if a['severity'] >= 8] What does the 'critical' variable contain after execution?