A security team is designing a playbook for a new incident type. They want the playbook to guide analysts through the following flow: first, identify the affected systems; then, if the systems are critical, apply immediate containment; otherwise, perform a deeper investigation; finally, document the incident. Which playbook structure best represents this flow?

A set of independent actions with no defined order

A linear sequence of tasks with no decision points

A single phase with multiple parallel tasks

A sequence of phases with a decision point that branches into two possible actions

A security team is creating a playbook for a data breach involving customer records. They want the playbook to clearly show the sequence of steps, including where a decision must be made about whether the breach involves personally identifiable information (PII). Which playbook structure best supports this requirement?

A flowchart with phases, tasks, and decision points, because it can visually represent the branching logic.

A linear list of tasks with no branching, because the team wants a simple sequence.

A list of triggers only, because the team wants to define when the playbook starts.

A table of expected outcomes only, because the team wants to focus on the end state.

A security analyst is reviewing a playbook for handling a suspected ransomware infection. The playbook begins with a section that lists specific indicators such as unusual file extensions and ransom notes, followed by a decision point that asks whether the affected host is a domain controller. If the answer is yes, the playbook directs the analyst to isolate the host and escalate to the incident commander. If no, it directs the analyst to continue with containment. Which component of the playbook is the analyst most directly interpreting when determining which branch to follow?

The condition component, because it evaluates a specific fact to select the next action.

The trigger section, because it defines the initial conditions that activate the playbook.

The action component, because it lists the steps to be executed after the decision.

The expected outcome section, because it states the desired end state of the response.

A playbook for a phishing incident has these steps in order: 1) Validate the email headers, 2) Determine if the user clicked the link, 3) If clicked, quarantine the user's machine, 4) If not clicked, delete the email. What should the analyst do if the user clicked the link?

Skip to the end of the playbook

Delete the email and close the incident

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 1

1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 3)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

20%of the exam

Questions 11–15

11application · medium
A security team is designing a playbook for a new incident type. They want the playbook to guide analysts through the following flow: first, identify the affected systems; then, if the systems are critical, apply immediate containment; otherwise, perform a deeper investigation; finally, document the incident. Which playbook structure best represents this flow?
Select an answer first
12application · medium
A security team is creating a playbook for a data breach involving customer records. They want the playbook to clearly show the sequence of steps, including where a decision must be made about whether the breach involves personally identifiable information (PII). Which playbook structure best supports this requirement?
Select an answer first
13foundation · easy
Which playbook component describes the desired result that should be achieved after a particular action is completed?
Select an answer first
14application · medium
A security analyst is reviewing a playbook for handling a suspected ransomware infection. The playbook begins with a section that lists specific indicators such as unusual file extensions and ransom notes, followed by a decision point that asks whether the affected host is a domain controller. If the answer is yes, the playbook directs the analyst to isolate the host and escalate to the incident commander. If no, it directs the analyst to continue with containment. Which component of the playbook is the analyst most directly interpreting when determining which branch to follow?
Select an answer first
15foundation · easy
A playbook for a phishing incident has these steps in order: 1) Validate the email headers, 2) Determine if the user clicked the link, 3) If clicked, quarantine the user's machine, 4) If not clicked, delete the email. What should the analyst do if the user clicked the link?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 3)

Questions 11–15

Which playbook component describes the desired result that should be achieved after a particular action is completed?

A playbook for a phishing incident has these steps in order: 1) Validate the email headers, 2) Determine if the user clicked the link, 3) If clicked, quarantine the user's machine, 4) If not clicked, delete the email. What should the analyst do if the user clicked the link?

Keep studying — Fundamentals