1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A playbook for a data breach includes the following steps: 1) Identify the data type involved, 2) If the data is regulated, notify legal; if not, proceed to step 3, 3) Contain the affected systems, 4) Notify the data owner. The analyst discovers that the data is regulated and also that the data owner is on vacation. What is the correct sequence of actions according to the playbook?

   • ANotify legal, contain the systems, and then notify the data owner
   • BNotify the data owner first, then legal, then contain
   • CContain the systems first, then notify legal and the data owner
   • DSkip legal notification because the data owner is unavailable
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a playbook, the 'expected outcome' of a containment step is 'the compromised host is isolated from the network.' What does this component tell the analyst?

   • AThe condition that must be true before the step runs
   • BThe result that should be verified after the step is completed
   • CThe exact command to run to isolate the host
   • DThe person responsible for performing the step
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Given the following playbook excerpt: Step 1: Check if the alert severity is 'high'. Step 2: If yes, escalate to the SOC manager. Step 3: If no, investigate the alert. What is the correct interpretation of this workflow?

   • AAll alerts are escalated to the SOC manager
   • BInvestigation always happens before escalation
   • CHigh-severity alerts are escalated, while lower-severity alerts are investigated
   • DThe SOC manager investigates all alerts
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A playbook for a web application attack includes these steps: 1) Review the web server logs for the attack pattern, 2) If the attack pattern matches a known exploit, block the source IP; if not, capture the logs for further analysis, 3) Report the incident to the security manager. The analyst reviews the logs and finds the attack pattern does NOT match a known exploit. What should the analyst do next?

   • ABlock the source IP and capture the logs
   • BReport the incident immediately without capturing logs
   • CCapture the logs for further analysis and then report the incident
   • DBlock the source IP and report the incident
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A playbook for a ransomware incident includes the following: 'When a ransomware alert is received, the analyst should isolate the affected host, then check if the host is a domain controller. If it is a domain controller, the analyst should coordinate with the identity team before proceeding.' Which component is the 'check if the host is a domain controller' step?

   • ATrigger
   • BAction
   • CExpected outcome
   • DCondition
   Reveal Solution Discussion Select an answer first