Performing CyberOps Using Cisco Security Technologies (CBRCOR) — Question 59

An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?

Answer options

• A. Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.
• B. Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.
• C. Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.
• D. Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.

Correct answer: C

Explanation

Option C is the correct answer because it automates the identification and alerting process for assets outside the PKI zone, allowing for efficient management of certificate updates. Option A, while useful, relies on manual ticketing processes that do not fully automate the workflow. Option B does not address the existing issues of tracking and managing certificates across different environments. Option D, although it helps in communication, does not provide a comprehensive solution for monitoring and managing certificate lifecycle issues.