300-215 Question 211
Select 4An organization is developing an incident response playbook to handle ransomware attacks. Which elements should be included to ensure the playbook is effective and comprehensive?
- A
Clear roles and responsibilities for the incident response team
- B
A list of all employees in the organization
- C
Defined communication protocols, including escalation paths
- D
Steps for evidence preservation and chain of custody
- E
A detailed history of all prior incidents in the organization
- F
Procedures for containment, eradication, and recovery
Show answer and explanation
Correct answers: A, C, D, F
Explanation
An incident response playbook must include key elements such as roles and responsibilities, communication protocols, evidence preservation steps, and procedures for containment, eradication, and recovery. These components ensure that the response is coordinated, effective, and compliant with legal and organizational requirements. Irrelevant elements, such as lists of all employees or a detailed history of prior incidents, do not address the immediate needs of incident response.
- A. Correct.
Clear roles and responsibilities ensure that every team member knows their function during an incident, reducing confusion and delays.
- B. Incorrect.
A list of all employees in the organization is not relevant to an incident response playbook. This would be more suited for HR or administrative purposes.
- C. Correct.
Defined communication protocols, including escalation paths, are crucial for ensuring effective coordination and timely decision-making during an incident.
- D. Correct.
Steps for evidence preservation and chain of custody are critical for maintaining the integrity of forensic data and preparing for potential legal actions.
- E. Incorrect.
A detailed history of all prior incidents is not an essential element of the playbook but may be part of broader organizational records or risk assessment processes.
- F. Correct.
Procedures for containment, eradication, and recovery are fundamental to any incident response playbook, as they guide the team on how to mitigate and resolve the incident.