350-201 Question 8
Select 3You are part of a security operations team and are tasked with automating the response to a phishing email incident. The playbook you are reviewing includes steps such as 'Email Header Analysis,' 'URL Reputation Check,' 'Quarantine Email,' and 'Notify Affected Users.' Which of the following are key components of this playbook that ensure an effective and automated response?
- A
Triggers that define when the playbook is initiated
- B
Defined steps for each action to be taken during the response
- C
A list of unaffected users to exclude from notifications
- D
Integration points with tools like email gateways and SIEM platforms
- E
Manual intervention steps to ensure human oversight at every stage
Show answer and explanation
Correct answers: A, B, D
Explanation
An effective playbook for phishing email incidents should include clearly defined triggers, step-by-step actions, and integration with relevant tools to ensure automation and efficiency. These components allow the playbook to be executed systematically and consistently. Manual steps can be included sparingly but are not required at every stage in an automated playbook.
- A. Correct.
Triggers are essential as they define the conditions under which the playbook is executed, ensuring timely response to incidents.
- B. Correct.
Defined steps outline the sequence of actions to be performed, making the playbook actionable and structured.
- C. Incorrect.
While excluding unaffected users could be important in some scenarios, it is not a core component of the playbook itself. This is more of a detail within a specific action in the playbook.
- D. Correct.
Integration points with relevant tools like email gateways and SIEM platforms are critical for automating processes and gathering necessary data.
- E. Incorrect.
Manual intervention at every stage negates the purpose of automation in playbooks. While human oversight might be needed at key decision points, it is not a requirement for every step.