1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does a playbook contribute to the standardization of incident response actions?

   • ABy documenting only the final outcome of an incident, not the process used to achieve it
   • BBy allowing each responder to choose their own preferred tools and methods for handling an incident
   • CBy providing a consistent, predefined sequence of steps that all responders follow for a given incident type
   • DBy automatically adjusting response steps based on the individual skills of each responder
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A large organization is experiencing a DDoS attack that is saturating its internet link. The security team has a mitigation plan that includes both on-premises appliances and a cloud-based scrubbing service. The attack is ongoing and the on-premises appliances are overwhelmed. Which action should the team take to maintain service availability while minimizing the impact of the attack?

   • ABlock all traffic from the attack source IPs at the perimeter.
   • BShut down the internet link until the attack subsides.
   • CIncrease the capacity of the on-premises appliances.
   • DActivate the cloud-based scrubbing service and reroute traffic through it.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In cybersecurity incident response, what is the primary purpose of a playbook?

   • ATo replace the need for human judgment by automatically executing all response actions without analyst involvement
   • BTo provide a predefined, step-by-step set of actions that standardize how an organization responds to a specific type of incident
   • CTo document the root cause analysis of a single past incident for historical reference only
   • DTo list the names and contact information of all incident response team members
   Reveal Solution Discussion Select an answer first
5. 9application · medium · select all that apply

   A company is under a DDoS attack. The attack is a mix of UDP flood and HTTP flood. The team is following the DDoS playbook. Select all actions that are appropriate during the mitigation phase.

   • AAnalyze attack traffic to adjust filtering rules.
   • BImplement rate limiting on the web server.
   • CIncrease server capacity to handle the additional traffic.
   • DActivate a DDoS protection service that filters malicious traffic.
   • EBlock all UDP traffic at the firewall.
   Check answers Discussion Select an answer first
6. 10application · medium

   A company's website is under a DDoS attack that is overwhelming the web server. The attack traffic appears to come from many different IP addresses. The team has activated a DDoS protection service, but the attack continues. What should the team do NEXT according to the DDoS playbook?

   • AAnalyze the attack traffic to identify patterns and adjust filtering rules.
   • BContact law enforcement to trace the attack source.
   • CShut down the website until the attack stops.
   • DIncrease the capacity of the web server to handle the additional traffic.
   Reveal Solution Discussion Select an answer first