Security+ topic 4.6
Automation, Orchestration, and Defensive AI
Automation lets a security team handle more with less effort and fewer mistakes. Scripts and playbooks can create accounts, enforce guardrails, open tickets, and respond to common alerts the same way every time. SOAR (security orchestration, automation and response) ties tools together so one alert can trigger many steps. New in SY0-801, AI helps defenders: chatbots answer staff questions, predictive analytics and behavioral baselines spot unusual activity, and agentic AI can take response steps on its own. Automation has risks too, such as complexity, cost, a single point of failure, and technical debt, so people still need to oversee it.
Automation, Orchestration, and Defensive AI vocabulary
- SOAR: Security orchestration, automation and response: tools that connect security systems and automate responses.
- Playbook: A step-by-step response plan, often automated, for a type of incident.
- Agentic AI: AI that can plan and take actions on its own to reach a goal.
- Behavioral baseline: A record of normal activity used to spot unusual behavior.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. When a phishing email is reported, a tool automatically pulls its links, checks them against threat feeds, blocks bad domains, and opens a ticket. Which of the following is this?
- (A) SOAR
- (B) DLP
- (C) A risk register
- (D) A WAF
Show answer
(A) SOAR SOAR orchestrates several tools to respond automatically.
2. An AI system learns what normal logins look like for each user and flags a login at 3 a.m. from a new device. Which of the following does the system rely on?
- (A) A behavioral baseline
- (B) A salt
- (C) A CRL
- (D) A hot site
Show answer
(A) A behavioral baseline Comparing activity with a baseline of normal behavior spots anomalies.
3. Which of the following is a risk of heavy security automation?
- (A) It always eliminates the need for staff
- (B) A single failure in the automation can affect many systems at once
- (C) It makes logs unreadable
- (D) It prevents patching
Show answer
(B) A single failure in the automation can affect many systems at once Automation can become a single point of failure and adds complexity.
4. An AI agent can isolate an infected laptop on its own when it sees ransomware behavior. Which of the following best describes it?
- (A) Agentic AI
- (B) A honeytoken
- (C) A deepfake
- (D) A data custodian
Show answer
(A) Agentic AI AI that takes actions on its own toward a goal is agentic AI.