1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A playbook for a malware outbreak requires the incident responder to isolate an infected workstation from the network while preserving the ability to collect forensic evidence from the host. Which tool category should the responder use to perform the isolation?

   • AVulnerability scanner
   • BNetwork-based intrusion prevention system (IPS)
   • CSecurity information and event management (SIEM) system
   • DEndpoint detection and response (EDR) platform
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security operations center is executing a playbook for a suspected data exfiltration incident. The playbook requires the analyst to (1) identify all outbound connections from a specific server to external IPs, (2) determine if any of those IPs are known malicious, and (3) block the malicious IPs at the perimeter. The analyst has access to a SIEM, a threat intelligence platform, a firewall, and an EDR. Which sequence of tools should the analyst use to complete the playbook efficiently?

   • AThreat intelligence platform to identify connections, SIEM to check IP reputation, EDR to block
   • BSIEM to identify connections, threat intelligence platform to check IP reputation, firewall to block
   • CEDR to identify connections, SIEM to check IP reputation, firewall to block
   • DFirewall to identify connections, EDR to check IP reputation, SIEM to block
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A playbook for a compromised endpoint requires the analyst to isolate the endpoint from the network, then collect a memory image for forensic analysis. The organization has an EDR, a SIEM, and a forensic imaging tool. The analyst needs to minimize the time the endpoint remains on the network. Which sequence of actions should the analyst take?

   • AIsolate the endpoint using the EDR, then collect a memory image using the forensic tool
   • BUse the SIEM to isolate the endpoint, then collect a memory image
   • CCollect a memory image first, then isolate the endpoint
   • DCollect a memory image using the EDR, then isolate using the SIEM
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is executing a playbook for a suspected phishing campaign. The playbook instructs the analyst to collect the email headers, extract the sender's IP address, and check whether that IP address has been observed in recent campaigns. Which tool should the analyst use to complete the IP address reputation check?

   • ANetwork access control (NAC) solution
   • BEndpoint detection and response (EDR) console
   • CSecurity information and event management (SIEM) system
   • DThreat intelligence platform
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A playbook for a data loss prevention (DLP) incident requires the analyst to identify which user copied sensitive data to a USB drive, and then to block the user's ability to use USB devices. The organization has a DLP solution, an EDR, and an identity provider (IdP). Which tool should the analyst use to identify the user?

   • AEDR
   • BIdentity provider (IdP)
   • CDLP solution
   • DSIEM
   Reveal Solution Discussion Select an answer first