1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A playbook for a brute-force attack on a web application requires the analyst to block the attacking IP addresses at the application layer. Which tool category is best suited for this task?

   • AEndpoint detection and response (EDR) platform
   • BSecurity information and event management (SIEM) system
   • CNetwork firewall
   • DWeb application firewall (WAF)
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A playbook for a compromised user account requires the analyst to reset the user's password, revoke active sessions, and then review the user's recent email activity for suspicious messages. The organization has an identity provider (IdP), an email security gateway, a SIEM, and a helpdesk ticketing system. Which sequence of tools should the analyst use?

   • AHelpdesk ticketing system for all actions
   • BSIEM for password reset and email review
   • CEmail security gateway for email review, then IdP for password reset
   • DIdP for password reset and session revocation, then email security gateway for email review
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   A playbook for a phishing campaign requires the analyst to identify all users who received the phishing email, determine which users clicked the malicious link, and then block the sender's domain at the email gateway. The organization has an email security gateway, a SIEM, and an EDR. The analyst has already identified the phishing email in the gateway logs. Which tool should the analyst use to identify users who clicked the link?

   • AEDR
   • BEmail security gateway
   • CSIEM
   • DThreat intelligence platform
   Reveal Solution Discussion Select an answer first