1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC analyst is following a playbook for a phishing email reported by a user. The playbook lists these steps in order: 1) Verify the email headers, 2) Check if the URL is on the blocklist, 3) If the URL is blocklisted, block the sender; if not, submit the URL for analysis, 4) Notify the user. The analyst has verified the headers and found the URL is not on the blocklist. According to the playbook, what should the analyst do next?

   • ANotify the user first, then submit the URL for analysis
   • BSkip to the end and close the ticket
   • CSubmit the URL for analysis and then notify the user
   • DBlock the sender and notify the user
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A playbook contains a step that says: 'If the file hash matches a known-bad hash, block the hash on the firewall.' What is the purpose of the 'if' clause in this step?

   • AIt describes the expected outcome of the action
   • BIt identifies the responsible team for the action
   • CIt defines the trigger for the playbook
   • DIt specifies the condition that must be met for the action to execute
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a typical security playbook, which section is most likely to appear immediately after the initial trigger or alert is received?

   • AInitial triage and validation of the alert
   • BContainment and eradication actions
   • CLessons learned and post-incident review
   • DFinal reporting and stakeholder notification
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   An incident responder is executing a playbook for a suspected insider threat. The playbook includes a step that says: 'If the user's access level is administrative, disable the account immediately; otherwise, monitor the account for 24 hours.' The responder has determined that the user has standard user access. What action should the responder take?

   • AMonitor the account for 24 hours because the user does not have administrative access.
   • BDisable the account and also monitor it for 24 hours to be safe.
   • CDisable the account immediately because the user is a potential insider threat.
   • DEscalate to the legal team before taking any action.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An incident responder is executing a playbook for a worm outbreak. The playbook has the following steps: 1) Identify the patient-zero host. 2) If the host is a server, isolate it and notify the server team. 3) If the host is a workstation, isolate it and notify the user's manager. 4) After either action, scan the entire network for other infected hosts. The responder has identified that the patient-zero host is a server. The responder is also aware that the server hosts a critical application that cannot be offline for more than 30 minutes. The playbook does not specify a time limit for isolation. What should the responder do?

   • AIsolate the server and notify the server team, then scan the network.
   • BSkip isolation and scan the network first to find other infected hosts.
   • CIsolate the server but do not notify the server team because the application is critical.
   • DNotify the user's manager because the host is infected, regardless of its role.
   Reveal Solution Discussion Select an answer first