KC-8 — Chapter 8 Knowledge Check

Questions

Select the best answer for each question.

1. What is the key difference between automation and orchestration?

A. They are the same thing

B. Automation executes a single task; orchestration coordinates multiple tools and steps into a complete workflow

C. Orchestration only applies to AI

D. Automation requires more human oversight than orchestration

2. Which of the following is an appropriate use of AI in a SOC, according to this chapter?

A. Independently determining incident severity

B. Making final legal or regulatory conclusions

C. Confirming evidence authenticity without analyst review

D. Summarizing telemetry to accelerate the start of an investigation

3. Why does this chapter caution against AI making autonomous security decisions?

A. Analysts remain accountable for validating conclusions and making operational decisions

B. AI is never useful in a SOC

C. AI cannot process security telemetry at all

D. Governance policies prohibit any AI use

4. What is the primary purpose of a SOAR platform?

A. To replace the Wazuh Manager

B. To generate Suricata signatures automatically

C. To reduce analyst workload by automating and orchestrating repetitive, well-understood investigative workflows

D. To eliminate the need for detection engineering

5. Why does this textbook emphasize principles (validate telemetry, correlate evidence, document reasoning) over specific tools?

A. Principles are easier to test on exams

B. Tools are unimportant in modern SOC operations

C. Principles replace the need to learn any software

D. Specific tools and platforms change over time, but the underlying investigative methodology remains valuable across a career

Answer Key