1.1 Interpret the Components Within a Playbook 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is reviewing a playbook for handling a suspected ransomware infection. The playbook contains a step that checks whether the file hash of the suspicious executable matches a known-bad list. If the hash matches, the playbook directs the analyst to isolate the host; if not, it directs the analyst to continue monitoring. Which two components of the playbook are the analyst primarily interpreting in this step?

   • APhase and task
   • BCondition and action
   • CAction and expected outcome
   • DTrigger and expected outcome
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team is creating a playbook for a new type of phishing campaign. They want the playbook to start when a user clicks a link in an email that is later determined to be malicious. They also want the playbook to include a step that checks whether the user's device is a corporate-managed device before applying containment actions. Which two components should the team include in the playbook to meet these requirements?

   • ATrigger and condition
   • BTrigger and action
   • CAction and expected outcome
   • DPhase and task
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is reviewing a playbook for a data breach. The playbook has a trigger: 'Alert from DLP system for sensitive data exfiltration.' The first phase is 'Identification,' which includes the task 'Confirm whether the data includes PII.' The next phase is 'Containment,' which includes the action 'If PII is present, notify legal within 1 hour; otherwise, continue with standard containment.' The team has received a DLP alert and confirmed that the data includes PII. The team is also aware that the breach may involve data from EU residents, which could trigger GDPR notification requirements. What should the team do according to the playbook?

   • AContinue with standard containment because the DLP alert was the trigger and the data is already identified.
   • BDelay notification until the full extent of the breach is known.
   • CNotify legal only if the data involves EU residents, because GDPR is the only relevant regulation.
   • DNotify legal within 1 hour because PII is present, and also consider GDPR notification requirements.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An incident responder is executing a playbook for a data exfiltration incident. The playbook includes a step that says: 'If the destination IP is in the approved external partners list, document the transfer and close the ticket; otherwise, escalate to the incident commander.' The responder finds the destination IP is NOT in the approved list. What is the responder's correct action according to the playbook?

   • ABlock the destination IP immediately
   • BDocument the transfer and close the ticket
   • CEscalate to the incident commander
   • DAsk the user if the transfer was authorized
   Reveal Solution Discussion Select an answer first
6. 35application · easy

   A SOC analyst is reading a playbook for a DDoS attack on a web application. The playbook lists the following: 'If the traffic rate exceeds 10 Gbps, enable rate limiting on the edge firewall.' The analyst sees that the current traffic rate is 8 Gbps. What should the analyst do according to the playbook?

   • AEnable rate limiting and also escalate to the network team for manual review.
   • BWait until the traffic rate reaches 10 Gbps before enabling rate limiting.
   • CEnable rate limiting immediately because the traffic is abnormally high.
   • DDisable the firewall because the traffic is below the threshold and the attack is not occurring.
   Reveal Solution Discussion Select an answer first