350-201 Question 5
Single answerYou are a security analyst tasked with analyzing a playbook designed to respond to phishing email incidents. The playbook includes the following steps: 'Email header analysis,' 'URL reputation check,' 'Quarantine email,' and 'User notification.' Which of the following best describes a critical component of this playbook?
- A
The use of an automated system to execute all steps
- B
The inclusion of specific, actionable steps to address the phishing email
- C
The involvement of an external threat intelligence feed
- D
The integration of a machine learning model to predict future phishing attempts
Show answer and explanation
Correct answer: B
Explanation
A playbook's primary purpose is to provide clear, actionable steps for responding to a specific incident type. In this case, the phishing email response playbook includes steps that guide the security team in analyzing, mitigating, and notifying stakeholders about the threat. While other tools and integrations can augment a playbook, the inclusion of actionable steps is the most critical component.
- A. Incorrect.
While automation is valuable, it is not a critical requirement for a playbook. Playbooks can also involve manual processes.
- B. Correct.
A playbook must include specific, actionable steps to guide the response process effectively. This is a critical component for ensuring consistency and clarity during incident response.
- C. Incorrect.
Using an external threat intelligence feed can enhance the playbook but is not mandatory for its creation or functionality.
- D. Incorrect.
Machine learning models may provide additional insights or predictions, but they are not essential components of a playbook's structure.