5.2 Building, Implementing, and Using Response Playbooks PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A playbook for a suspected data exfiltration incident includes enrichment steps: checking the user's access history, querying threat intelligence for the destination IP, and reviewing the data classification of the files accessed. The playbook must prioritize enrichments to quickly determine if the incident is a true positive. Which enrichment should be performed first?

   • ACorrelate the user's activity with the file access logs
   • BReview the data classification of the files accessed
   • CCheck the user's access history
   • DQuery threat intelligence for the destination IP
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is building a playbook for phishing email triage. The playbook includes steps to extract URLs, detonate them in a sandbox, and block malicious domains. The team wants to automate as many steps as possible without introducing risk. Which step is the best candidate for full automation?

   • ADeciding whether the email is a phishing attempt
   • BBlocking the malicious domain on the firewall
   • CNotifying the affected user that their credentials were compromised
   • DExtracting URLs from the email and submitting them to the sandbox
   Reveal Solution Discussion Select an answer first
3. 23foundation · easy

   Which characteristic makes a response step a good candidate for automation in a playbook?

   • AThe step changes based on the analyst's experience level
   • BThe step involves negotiating with external parties
   • CThe step requires subjective analysis of the attacker's intent
   • DThe step is performed identically every time and has a low chance of error
   Reveal Solution Discussion Select an answer first