Question 2What does a security team do when updating and improving a playbook? Select all that apply.1 pointConsider learnings from past security incidentsDiscuss ways to improve security postureImprove antivirus software performanceRefine response strategies for future incidents

Question 1Playbooks are permanent, best-practice documents, so a security team should not make changes to them.1 pointTrueFalse2.Question 2A business recently experienced a security breach. Security professionals are currently restoring the affected data using a clean backup that was created before the incident. What playbook phase does this scenario describe?1 pointContainmentPost-incident activityDetection and analysisEradication and recovery3.Question 3Fill in the blank: Once a security incident is resolved, security analysts perform various post-incident activities and _____ efforts with the security team. 1 pointeradicationcoordinationpreparationdetection4.Question 4Which action can a security analyst take when they are assessing a SIEM alert?1 pointAnalyze log data and related metricsIsolate an infected network systemRestore the affected data with a clean backupCreate a final report

Fill in the blank: A security team _____ their playbook frequently by learning from past security incidents, then refining policies and procedures.1 pointshortensupdatessummarizesoutlines

1.Question 1Which of the following statements accurately describe playbooks? Select three answers.1 pointA playbook is an essential tool used in cybersecurity.A playbook is used to develop compliance regulations.A playbook can be used to respond to an incidentA playbook improves efficiency when identifying and mitigating an incident.2.Question 2Fill in the blank: A security team _____ their playbook frequently by learning from past security incidents, then refining policies and procedures.1 pointoutlinesshortenssummarizesupdates3.Question 3Fill in the blank: Incident response is an organization’s quick attempt to _____ an attack, contain the damage, and correct its effects.1 pointdiscloseignoreexpandidentify4.Question 4An organization has successfully responded to a security incident. According to their established standards, the organization must share information about the incident to a specific government agency. What phase of an incident response playbook does this scenario describe?1 pointContainmentCoordinationDetection and analysisPreparation5.Question 5Which phase of an incident response playbook is primarily concerned with preventing further damage and reducing the immediate impact of a security incident?1 pointPost-incident activityPreparationContainmentDetection and analysis6.Question 6Fill in the blank: During the _____ phase, security teams may conduct a full-scale analysis to determine the root cause of an incident and use what they learn to improve the company’s overall security posture.1 pointeradication and recoverydetection and analysispost-incident activitycontainment7.Question 7A security analyst wants to set the foundation for successful incident response. They outline roles and responsibilities of each security team member. What phase of an incident response playbook does this scenario describe? 1 pointContainmentPost-incident activityPreparationDetection and analysis8.Question 8In what ways do SIEM tools and playbooks help security teams respond to an incident? Select all that apply.1 pointSIEM tools alert the security team to potential problems.Playbooks collect and analyze data.SIEM tools and playbooks work together to provide a structured way of responding to incidents.SIEM tools detect threats.

.Question 2A security team is considering what they learned during past security incidents. They also discuss ways to improve their security posture and refine response strategies for future incidents. What is the security team’s goal in this scenario?1 pointUpdate a playbookAssess employee performanceEducate clientsDelete biometric data

Question 2A business recently experienced a security breach. Security professionals are currently restoring the affected data using a clean backup that was created before the incident. What playbook phase does this scenario describe?1 pointDetection and analysisContainmentEradication and recoveryPost-incident activity