350-201 Question 6
Select 3A cybersecurity team is tasked with automating their incident response process using a playbook. The team’s playbook includes components such as triggers, conditions, and actions. Which of the following elements are correctly interpreted as key components of a security playbook?
- A
A trigger that initiates the playbook when specific conditions, such as an alert, are met.
- B
A condition that defines contextual parameters, such as the severity of an alert or affected assets.
- C
A manual step requiring an analyst to review and approve every action before execution.
- D
An action that specifies the tasks to be executed, such as isolating a compromised endpoint or blocking an IP address.
- E
A log of all past incidents and their resolutions for reference.
Show answer and explanation
Correct answers: A, B, D
Explanation
A playbook is a predefined workflow that automates incident response processes. Key components include triggers to initiate the playbook, conditions to evaluate the context, and actions to execute specific tasks. These elements work together to streamline and standardize responses to cybersecurity incidents, reducing reaction time and minimizing human error.
- A. Correct.
A trigger is a valid component of a playbook as it defines the event or condition that initiates the workflow.
- B. Correct.
Conditions are used to determine whether specific criteria are met before proceeding with actions, making them an essential part of a playbook.
- C. Incorrect.
While manual interventions can occur in incident response, requiring an analyst to review every action negates the automation purpose of a playbook. Thus, this is not a key playbook component.
- D. Correct.
Actions are critical components of a playbook as they define the tasks to be carried out during incident response.
- E. Incorrect.
A log of past incidents is useful for reference and analysis but does not constitute a key component of a playbook.