300-215 Question 213
Select 3A cybersecurity team is developing an incident response playbook for dealing with a suspected ransomware attack. Which of the following elements are essential to include in the playbook to ensure an effective response to this type of incident?
- A
Detailed steps for isolating affected systems from the network
- B
A list of known vulnerabilities in the organization’s infrastructure
- C
Guidelines for evidence collection and preservation during the investigation
- D
Communication protocols for notifying internal stakeholders and law enforcement
- E
A history of past ransomware incidents within the organization
Show answer and explanation
Correct answers: A, C, D
Explanation
An effective incident response playbook for ransomware incidents must include actionable and specific steps to mitigate the attack, preserve evidence, and communicate effectively with stakeholders. Elements like isolating systems, evidence collection, and communication protocols are essential for a coordinated and effective response. While some elements, like a list of known vulnerabilities or historical data, may be useful in a broader context, they are not directly part of the playbook's immediate requirements.
- A. Correct.
Isolating affected systems is a critical step in mitigating the spread of ransomware and protecting unaffected systems. This is a key element in any incident response playbook for ransomware.
- B. Incorrect.
While a list of known vulnerabilities is useful for proactive security measures, it is not a direct element required in an incident response playbook for ransomware incidents.
- C. Correct.
Guidelines for evidence collection and preservation ensure that any forensic analysis during or after the incident adheres to legal and procedural standards. This is an essential part of the playbook.
- D. Correct.
Clear communication protocols are vital for coordinating with internal teams and external entities like law enforcement. This ensures a cohesive and efficient response to the incident.
- E. Incorrect.
Although a history of past incidents may provide some context, it is not a required element in the playbook itself. The playbook focuses on actionable steps for immediate response.