300-215 Question 209
Select 4Your organization has recently faced a ransomware attack. As part of the post-incident review, you are tasked with evaluating the incident response playbook to ensure it is effective for future incidents. Which elements must be included in the playbook to ensure a comprehensive response to such incidents?
- A
Clearly defined roles and responsibilities for incident response team members
- B
Detailed step-by-step instructions for using third-party forensic tools
- C
A communication plan for internal and external stakeholders
- D
A list of all historical incidents encountered by the organization
- E
A process for escalation and decision-making during the incident
- F
Guidelines for evidence preservation and chain of custody
Show answer and explanation
Correct answers: A, C, E, F
Explanation
A well-structured incident response playbook must include essential elements such as clearly defined roles, a communication plan, escalation processes, and evidence-handling guidelines. These components ensure the organization can respond effectively, minimize damage, and maintain compliance with legal and regulatory requirements. While other elements like historical incidents or tool-specific instructions can be helpful, they are not mandatory for an effective playbook.
- A. Correct.
Clearly defined roles and responsibilities are critical to ensure that each team member knows their duties during an incident, which helps streamline the response process and avoids confusion.
- B. Incorrect.
While instructions for using tools can be helpful, it is not a required element of every playbook as tools and their usage can vary depending on the incident.
- C. Correct.
A communication plan is essential to ensure that the right information is shared with stakeholders and to maintain transparency during the response process.
- D. Incorrect.
While historical incidents can inform future responses, listing all historical incidents in the playbook is not a required element and is not practical in most scenarios.
- E. Correct.
A process for escalation and decision-making ensures that incidents are handled appropriately and that critical decisions are made in a timely manner.
- F. Correct.
Guidelines for evidence preservation and chain of custody are crucial to ensure that any forensic evidence collected during an incident is admissible in legal proceedings and maintains its integrity.