Q: 10
Which of the following is most appropriate to use with SOAR when the security team would like to
automate actions across different vendor platforms?
Options
Discussion
B . APIs are how SOAR actually connects and automates between different vendors. Not 100 percent but that's what I'd pick.
B . APIs actually let SOAR automate stuff between lots of vendors, not just share data like threat feeds do.
Option B. saw a similar question in practice sets and APIs were always the right pick for automation.
Option B
B here. APIs are what let SOAR actually carry out automated actions across all those different vendor tools, not just exchange info like STIX/TAXII. Pretty sure that's what CompTIA wants. Correct me if I missed something.
B not A. APIs let SOAR actually automate actions, while STIX/TAXII is more about threat intel sharing, which trips people up. Seen this mix-up on other practice questions too.
A looks right to me, since STIX/TAXII is used for exchanging info between vendors. I know APIs can automate tasks but STIX/TAXII is what I've always seen for cross-platform stuff. Pretty sure that's where they're going, unless I'm missing some nuance. Disagree?
Its B, APIs. That’s the main way SOAR platforms actually automate actions with different vendors, not just pull in threat intel. Seen similar stuff on official practice exams. If anyone’s got another take, let me know.
A , since if the platforms only support STIX/TAXII sharing then APIs aren't always enough.
B , APIs are what actually let SOAR automate things with multiple vendors, not threat feeds like D.
Be respectful. No spam.
