1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a playbook, which component defines the specific event or alert that causes the playbook to be executed?

   • AAction
   • BTrigger
   • CExpected outcome
   • DCondition
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   An incident responder is executing a playbook for a suspected account compromise. The playbook includes the following: 'If the account has MFA enabled, reset the password and keep the account active. If MFA is not enabled, disable the account and escalate to the security team.' The responder has confirmed that the account does not have MFA enabled. What should the responder do?

   • ADisable the account and escalate to the security team.
   • BReset the password and keep the account active because the user needs access.
   • CReset the password and also disable the account to be safe.
   • DDisable the account but do not escalate because the user is not a threat.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A playbook for a network intrusion includes the following: 'If the source IP is in the threat intelligence feed, block the IP; otherwise, monitor the traffic for 24 hours.' The analyst sees traffic from an IP that is NOT in the threat intelligence feed, but the traffic pattern is clearly malicious. What should the analyst do?

   • AAdd the IP to the threat intelligence feed and then block it
   • BMonitor the traffic for 24 hours as directed by the playbook
   • CEscalate to the incident commander for a decision
   • DBlock the IP because the traffic is clearly malicious
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC is responding to a ransomware incident. The playbook has two phases: 'Containment' and 'Eradication.' In Containment, the first task is 'Isolate the affected host.' The next task is 'If the host is a domain controller, do not isolate; instead, disable the network interface and escalate.' The playbook then proceeds to Eradication, which includes 'Remove the malware' and 'Restore from backup.' The analyst has identified that the affected host is a domain controller. The analyst is concerned that isolating the host will disrupt authentication for the entire domain. What should the analyst do according to the playbook?

   • ADisable the network interface and escalate, as the playbook directs for domain controllers.
   • BSkip containment and proceed directly to eradication to minimize downtime.
   • CRestore from backup immediately without isolating the host.
   • DIsolate the host as the first task says, because containment is the priority.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which element in a playbook is used to represent a branch in the workflow where the next step depends on a specific condition?

   • AExpected outcome
   • BTrigger
   • CDecision point
   • DAction step
   Reveal Solution Discussion Select an answer first