.Question 6Fill in the blank: During the _____ phase, security teams may conduct a full-scale analysis to determine the root cause of an incident and use what they learn to improve the company’s overall security posture.1 pointpost-incident activityeradication and recoverydetection and analysiscontainmen

Question 3Fill in the blank: Once a security incident is resolved, security analysts perform various post-incident activities and _____ efforts with the security team. 1 pointdetectioncoordinationeradicationpreparation

Question 2Fill in the blank: During the _____ phase, security professionals use tools and strategies to determine whether a breach has occurred and to evaluate its potential magnitude.1 pointpreparationcoordinationdetection and analysiscontainment3.Question 3

4.Question 4A security analyst wants to ensure an organized response and resolution to a security breach. They share information with key stakeholders based on the organization’s established standards. What phase of an incident response playbook does this scenario describe? 1 pointCoordinationDetection and analysisContainmentEradication and recovery

Which phase of an incident response playbook is primarily concerned with preventing further damage and reducing the immediate impact of a security incident?1 pointDetection and analysisPost-incident activityContainmentPreparation

Question 1Playbooks are permanent, best-practice documents, so a security team should not make changes to them.1 pointTrueFalse2.Question 2A business recently experienced a security breach. Security professionals are currently restoring the affected data using a clean backup that was created before the incident. What playbook phase does this scenario describe?1 pointContainmentPost-incident activityDetection and analysisEradication and recovery3.Question 3Fill in the blank: Once a security incident is resolved, security analysts perform various post-incident activities and _____ efforts with the security team. 1 pointeradicationcoordinationpreparationdetection4.Question 4Which action can a security analyst take when they are assessing a SIEM alert?1 pointAnalyze log data and related metricsIsolate an infected network systemRestore the affected data with a clean backupCreate a final report