Module assessment

1.

Contoso Financial Services runs the standard six areas of work. Its current pipeline from initial threat intelligence extraction to new detection rules typically takes eight business days as findings move across specialist queues. Contoso's leadership is evaluating whether Project Perception can compress that pipeline. Which statement best explains what Project Perception changes to make the compression possible?

Project Perception replaces the six areas of work with a single unified security analysis process that no longer requires separate specialists for threat intelligence, attack path analysis, or detection engineering.

Project Perception runs Contoso's six existing areas of work as one continuously connected workflow, so each area's output flows into the next through shared security context instead of waiting in specialist queues.

Project Perception skips the threat intelligence extraction and attack path analysis areas by having AI generate detection rules directly from the raw advisory, cutting four areas out of the pipeline.

2.

Continuing the scenario: A new threat intelligence advisory arrives at Contoso about a state-linked actor. The SOC lead wants to run the Protect against a threat playbook against the advisory. Which sequence of work does that playbook orchestrate, and how do the participating Project Perception agents map to the Red, Blue, and Green teams of agents?

Threat intelligence analysis (Threat Intelligence Agent, Blue), then attack path analysis (Recon Agent, Red), then posture prioritization (Posture Prioritization Agent, Green), then detection engineering (Detection Authoring Agent, Blue). Four areas of work across all three teams.

All four steps run on Blue team agents (Threat Intelligence Agent, Attack Investigation Agent, Detection Authoring Agent, Security Alert Triage Agent), because Blue covers investigate and assess risk.

Attack path analysis and posture prioritization both run on Green team agents, because both are hardening-oriented areas of work.

3.

Continuing the scenario: While the Protect against a threat playbook runs, a separate Contoso alert triage analyst is working through a suspicious sign-in alert on a VIP account. The analyst wants a fast summary of the alert stack, a KQL query to check for related activity elsewhere in the tenant, and a read on the account's recent behavior. Which best describes the shape of the response this situation calls for?

The Protect against a threat playbook, extended to cover this alert as another input to its workflow.

A Project Perception playbook focused on one area that runs alert triage end to end on this specific VIP alert.

Work that stays inside one area, handled inside the alert triage tools the analyst already uses. This situation isn't the shape a Project Perception playbook is built for.

4.

Continuing the scenario: The Protect against a threat playbook has finished and produced a coordinated report showing two internet-facing Contoso applications present the paths the actor exploits. An analyst reviewing the report wants to dig into one specific investigation subtree, ask follow-up questions about one indicator of compromise, and run an exploratory KQL query for a pattern the playbook didn't cover. Which best describes the shape of the response this situation calls for?

Coordinate across areas only. Re-trigger the playbook with the analyst's follow-up questions added as another stage inside its workflow.

Both at once. Project Perception's coordinated output is the substrate the analyst is working from, and the analyst does work inside incident investigation on the specific subtree, IOC follow-up, and exploratory KQL.

Work that stays inside one area only. Now that the playbook has finished, all remaining work is inside incident investigation, and the playbook's role in the situation ends when its run completes.

Feedback