300-215 Question 212
Select 3You are tasked with creating an incident response (IR) playbook for your organization using Cisco SecureX orchestration. During a tabletop exercise, a team member questions whether the playbook is complete. Which of the following elements should be included in the playbook to ensure it is effective and comprehensive?
- A
Defined roles and responsibilities for all stakeholders
- B
Detailed incident timelines from previous breaches
- C
A clear escalation process for critical incidents
- D
Pre-approved communication templates for internal and external communication
- E
A list of all IP addresses and endpoints in the organization
Show answer and explanation
Correct answers: A, C, D
Explanation
An effective incident response playbook must include actionable and clearly defined processes, such as roles and responsibilities, an escalation process, and pre-approved communication templates. These elements ensure that the organization can respond quickly and efficiently during an incident. While historical timelines and asset inventories are useful in other contexts, they are not mandatory components of an IR playbook.
- A. Correct.
Defined roles and responsibilities are critical to ensure all stakeholders understand their specific duties during an incident response. Without these, confusion and delays can occur.
- B. Incorrect.
While incident timelines from previous breaches can provide historical insights, they are not a required element of an IR playbook. The focus is on actionable steps for current and future incidents.
- C. Correct.
A clear escalation process is essential to ensure incidents are properly prioritized and handled efficiently by the right teams.
- D. Correct.
Pre-approved communication templates help ensure consistent and timely communication during an incident, which is crucial for both internal coordination and external transparency.
- E. Incorrect.
A list of all IP addresses and endpoints in the organization is helpful for asset management but is not a required element of an IR playbook. The playbook focuses on processes and procedures.