Module 4-02 Challenge

Question 1

Which of the following statements accurately describe playbooks? Select three answers.

• A playbook clarifies what tools to use in response to a security incident.
• Organizations use the same playbook for incident response, security alerts, and product-specific purposes.
• A playbook is a manual that provides details about any operational action.
• Organizations use playbooks to ensure employees follow a consistent list of actions.

Answer 1

• A playbook clarifies what tools to use in response to a security incident.
• A playbook is a manual that provides details about any operational action.
• Organizations use playbooks to ensure employees follow a consistent list of actions.

Question 2

A security team is considering what they learned during past security incidents. They also discuss ways to improve their security posture and refine response strategies for future incidents. What is the security team’s goal in this scenario?

• Assess employee performance
• Update a playbook
• Delete biometric data
• Educate clients

Answer 2

Update a playbook

Question 3

Incident response playbooks outline processes for communication and ______ of a security breach.

• implementation
• iteration
• concealment
• documentation

Answer 3

documentation

Question 4

An organization has successfully responded to a security incident. According to their established standards, the organization must share information about the incident to a specific government agency. What phase of an incident response playbook does this scenario describe?

• Coordination
• Containment
• Preparation
• Detection and analysis

Answer 4

Coordination

Question 5

Which phase of an incident response playbook is primarily concerned with preventing further damage and reducing the immediate impact of a security incident?

• Post-incident activity
• Detection and analysis
• Preparation
• Containment

Answer 5

Containment

Question 6

During the _____ phase, security teams may conduct a full-scale analysis to determine the root cause of an incident and use what they learn to improve the company’s overall security posture.

• containment
• detection and analysis
• eradication and recovery
• post-incident activity

Answer 6

post-incident activity

Question 7

A security analyst documents procedures to be followed in the event of a security breach. They also establish staffing plans and educate employees. What phase of an incident response playbook does this scenario describe?

• Preparation
• Coordination
• Eradication and recovery
• Detection and analysis

Answer 7

Preparation

Question 8

In what ways do SIEM tools and playbooks help security teams respond to an incident? Select all that apply.

• SIEM tools alert the security team to potential problems.
• Playbooks collect and analyze data.
• SIEM tools and playbooks work together to provide a structured way of responding to incidents.
• SIEM tools detect threats.
• Playbooks analyze data to detect threats.
• After receiving a SIEM alert, security teams use playbooks to guide their response process.
• SIEM tools generate alerts.
• SIEM tools collect data.

Answer 8

• SIEM tools alert the security team to potential problems.
• SIEM tools and playbooks work together to provide a structured way of responding to incidents.
• SIEM tools detect threats.
• After receiving a SIEM alert, security teams use playbooks to guide their response process.
• SIEM tools generate alerts.
• SIEM tools collect data.

Question 9

What does a security team do when updating and improving a playbook? Select all that apply.

• Consider learnings from past security incidents
• Refine response strategies for future incidents
• Improve antivirus software performance
• Discuss ways to improve security posture

Answer 9

• Consider learnings from past security incidents
• Refine response strategies for future incidents
• Discuss ways to improve security posture

Question 10

Incident response playbooks are _____ used to help mitigate and manage security incidents from beginning to end.

• inquiries
• guides
• exercises
• examinations

Answer 10

guides

Question 11

A security analyst wants to set the foundation for successful incident response. They outline roles and responsibilities of each security team member. What phase of an incident response playbook does this scenario describe?

• Post-incident activity
• Preparation
• Detection and analysis
• Containment

Answer 11

Preparation