Cisco Cyber Security Practice Exam

Which of the following is NOT a function of SOAR systems?

1. Threat assessment

2. Vulnerability scanning

3. Incident response automation

4. Compliance reporting

The correct answer is: Compliance reporting

SOAR (Security Orchestration, Automation, and Response) systems primarily focus on improving the efficiency and effectiveness of security operations through the automation of incident response processes and the orchestration of various security tools and workflows. While compliance reporting is an important aspect of cybersecurity and can be part of a broader security strategy, it is not a core function of SOAR systems. SOAR systems are designed to streamline incident detection, response, and management. They help security teams by automating repetitive tasks, integrating with other tools to gather context and data, and providing frameworks for responding to threats. Functions such as threat assessment—evaluating and prioritizing threats based on risk and impact—and incident response automation—automating the processes to respond to incidents—are critical aspects of what SOAR solutions aim to achieve. Vulnerability scanning, while related, focuses on identifying weaknesses in systems and networks rather than the orchestration and automation functions central to SOAR. In summary, compliance reporting, while significant, is more closely related to regulatory requirements and governance rather than the operational focus of SOAR systems, which prioritize threat management and incident handling.