1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SOC is executing a playbook for a malware outbreak. The playbook has a step that says: 'If the infected host is a domain controller, coordinate with the identity team before isolating; otherwise, isolate immediately.' The analyst receives a malware alert for a host that is a domain controller. However, the identity team is currently unavailable due to an ongoing outage. The analyst must decide how to proceed while following the playbook's intent. What should the analyst do?

   • AIsolate the host and then attempt to contact the identity team
   • BDisable the domain controller's network access without isolating it
   • CIsolate the host immediately and document that the identity team was unavailable
   • DWait for the identity team to become available before taking any action
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An incident responder is executing a playbook for a suspected data exfiltration. The playbook has the following steps: 1) Identify the source of the exfiltration. 2) If the source is an internal user, disable the user's account. 3) If the source is an external attacker, block the attacker's IP. 4) After either action, notify the security manager. The responder has identified that the source is an internal user who is also a senior executive. The responder is concerned that disabling the account will cause reputational damage. What should the responder do?

   • ADisable the user's account and notify the security manager, as the playbook directs.
   • BBlock the user's IP instead of disabling the account to avoid reputational damage.
   • CDisable the account but do not notify the security manager to avoid escalation.
   • DNotify the security manager first, then disable the account.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is reviewing a playbook for a ransomware incident. The playbook has a trigger: 'Ransom note discovered on a workstation.' The first phase is 'Containment,' which includes the task 'Isolate the workstation.' The next phase is 'Eradication,' which includes the action 'Remove the malware and restore from backup.' The team has discovered a ransom note on a workstation that is also used for administrative tasks. The team is concerned that isolating the workstation will prevent the administrator from performing critical tasks. What should the team do?

   • AIsolate the workstation but also restore from backup immediately.
   • BSkip isolation and proceed directly to eradication to allow the administrator to continue working.
   • CDisable the administrative account before isolating the workstation.
   • DIsolate the workstation as the playbook directs, because the trigger and containment task apply.
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A security analyst is executing a playbook for a DDoS attack. The playbook has the following steps: 1) Verify the attack by checking traffic volume. 2) If traffic volume exceeds 20 Gbps, enable rate limiting. 3) If traffic volume is between 10 and 20 Gbps, monitor for 30 minutes. 4) If traffic volume is below 10 Gbps, close the ticket. 5) After any action, notify the network team. The analyst observes that the traffic volume is 15 Gbps. What should the analyst do?

   • AEnable rate limiting because the traffic is above 10 Gbps.
   • BMonitor for 30 minutes, then notify the network team.
   • CNotify the network team first, then monitor for 30 minutes.
   • DClose the ticket because the traffic is below 20 Gbps.
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   A junior analyst is reviewing a playbook for a malware outbreak. The playbook includes a section titled 'Triggers' that lists 'Endpoint detection alert for Trojan.GenericKD' and 'User report of slow computer with pop-ups.' The analyst is trying to determine whether a specific alert should initiate the playbook. Which statement best describes the role of the trigger in this context?

   • AThe trigger defines the conditions that must be true for the playbook to start.
   • BThe trigger specifies the final outcome that the playbook should achieve.
   • CThe trigger determines which team member is responsible for executing the playbook.
   • DThe trigger lists the actions to be taken during the response.
   Reveal Solution Discussion Select an answer first