1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A playbook for a compromised account includes the following instruction: 'If the account is a service account, coordinate with the application owner before disabling it; otherwise, disable the account immediately.' The analyst discovers the compromised account is a service account. What is the correct interpretation of this playbook step?

   • ADisable the account and then notify the application owner
   • BDisable the account immediately because it is compromised
   • CIgnore the service account status and disable it
   • DCoordinate with the application owner before disabling the account
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A junior analyst is reviewing a playbook for a malware outbreak. The playbook is organized into sections: 'Preparation', 'Detection and Analysis', 'Containment, Eradication, and Recovery', and 'Post-Incident Activity'. Within the 'Containment, Eradication, and Recovery' section, there is a step that says: 'If the infected host is a domain controller, coordinate with the identity team before isolating.' What is the purpose of this step in the playbook structure?

   • AIt is a trigger that initiates the containment phase
   • BIt is a task that must be performed in every malware outbreak
   • CIt is an expected outcome that defines the end state of the incident
   • DIt is a decision point that introduces a dependency on another team before an action
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   A security analyst is reviewing a playbook for a phishing campaign. The playbook includes a section that describes the desired end state: 'All malicious emails are quarantined, the sender is blocked, and the user is notified.' The analyst is trying to understand what this section represents. Which playbook component is this?

   • ACondition, because it specifies a logical check.
   • BAction, because it lists the steps to be taken.
   • CExpected outcome, because it describes the goal the playbook aims to achieve.
   • DTrigger, because it defines when the playbook should be activated.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A playbook for a DDoS incident includes the following step: 'If the attack traffic originates from a single source IP, apply a blackhole route; otherwise, engage the upstream provider for rate limiting.' The analyst sees that the attack is coming from a distributed botnet with many source IPs. What should the analyst do according to the playbook?

   • AEngage the upstream provider for rate limiting
   • BApply a blackhole route to all source IPs
   • CApply a blackhole route to the single source IP
   • DWait for the attack to stop before taking action
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC analyst is following a playbook for a network intrusion. The playbook has the following steps: 1) Collect packet captures. 2) Analyze the traffic for indicators of compromise. 3) If indicators are found, block the source IP. 4) If no indicators are found, close the ticket. 5) Document findings. The analyst has completed step 2 and found indicators of compromise. What should the analyst do next?

   • ADocument findings first, then block the source IP.
   • BClose the ticket because the analysis is complete.
   • CBlock the source IP, then document findings.
   • DCollect more packet captures before taking any action.
   Reveal Solution Discussion Select an answer first