300-215 Question 210
Select 4A security operations team is tasked with creating an incident response playbook for potential ransomware attacks. Which of the following elements must be included to ensure an effective and comprehensive response?
- A
Identification of critical assets and data to prioritize during an incident
- B
A detailed inventory of all IT hardware across the organization
- C
Clear escalation paths and communication plans during an incident
- D
Procedures for evidence collection and chain of custody preservation
- E
Details about daily monitoring thresholds for network traffic
- F
Post-incident activities such as lessons learned and playbook updates
Show answer and explanation
Correct answers: A, C, D, F
Explanation
An effective incident response playbook must include elements that enable the team to detect, respond, and recover from incidents efficiently. Identifying critical assets (to prioritize protection), establishing clear communication paths, preserving evidence (for legal and forensic purposes), and planning post-incident activities (to improve future responses) are all critical components. While IT asset inventories and monitoring thresholds are useful for broader security practices, they do not directly address the core requirements of an incident response playbook.
- A. Correct.
Correct. Identifying critical assets and data is essential to prioritize response efforts and protect the most valuable resources during an incident.
- B. Incorrect.
Incorrect. While an IT hardware inventory is useful for general IT management, it is not a core element of an incident response playbook.
- C. Correct.
Correct. Escalation paths and communication plans ensure the right stakeholders are informed and response efforts are coordinated effectively.
- D. Correct.
Correct. Procedures for evidence collection and chain of custody preservation are critical for forensic analysis and potential legal proceedings.
- E. Incorrect.
Incorrect. Monitoring thresholds are part of routine security operations but are not a key element in incident response playbooks.
- F. Correct.
Correct. Post-incident activities like conducting a lessons-learned session and updating the playbook improve future response readiness.