Security+ Incident Response Process and Playbooks

1. What is a key advantage of having pre-defined playbooks in an organization?

Eliminates the need for security training

Reduces response time and ensures consistent procedures

Prevents all security incidents from occurring

Removes responsibility from security personnel

2. Which of the following is NOT typically a component of an incident response playbook?

Communication procedures

Escalation paths

Employee vacation schedules

Containment steps

3. True or False: Incident severity should be assessed based only on the type of malware detected.

True

False

Submit

6. Which containment strategy is most appropriate for a suspected data exfiltration?

Immediately shut down all systems

Isolate affected systems while preserving evidence

Continue normal operations without changes

Alert the attacker to cease activity

7. What is the primary purpose of a post-incident review or lessons learned session?

To blame individuals for the incident

To identify improvements and update playbooks

To terminate employee contracts

To avoid future security investments

8. True or False: Incident response playbooks should only be accessible to the security team.

True

False

9. Which metric is most important for measuring incident response effectiveness?

Total number of incidents reported

Mean time to detect and mean time to respond

Number of employees trained

Frequency of playbook updates

10. During an incident, who should be notified according to a typical playbook?

Only the IT department

Legal, HR, management, and relevant stakeholders

Only the CEO

No one until the incident is fully resolved

11. Which phase of incident response focuses on stopping the attacker's activity and limiting damage?

Detection

Containment

Eradication

Recovery

12. True or False: Chain of custody procedures are essential during evidence collection in incident response.

True

False

13. Which type of playbook addresses responses to ransomware attacks?

Generic playbook

Incident-type specific playbook

Compliance playbook

Training playbook

14. What should be documented during the detection phase of incident response?

Only the attacker's IP address

Alert details, timestamp, and initial impact assessment

Complete system shutdown procedures

Financial cost estimates only

15. Which role is responsible for coordinating the overall incident response effort?

Network administrator

Incident commander

Help desk technician

Backup operator

16. True or False: A playbook should be static and never updated after initial creation.

True

False

17. What is the goal of the recovery phase in incident response?

Identify how the attacker gained access

Restore systems to normal operations and verify functionality

Conduct a full security audit

Terminate all employee accounts

18. Which communication channel should be used first when reporting a critical incident to leadership?

Email to all company staff

Established incident notification playbook

Social media announcement

Customer website bulletin

19. During the eradication phase, what action is most critical?

Notify all external stakeholders immediately

Remove the attacker's access and malware from systems

Restore all backups without verification

Shut down the entire network

20. What is the primary purpose of an incident response playbook?

Document historical security breaches

Provide step-by-step procedures for handling specific incident types

Train new security analysts on general IT skills

Archive all security logs and alerts

Security+ Incident Response Process and Playbooks Quiz

1. What is a key advantage of having pre-defined playbooks in an organization?

2.

What first name or nickname would you like us to use?

2. Which of the following is NOT typically a component of an incident response playbook?

3. True or False: Incident severity should be assessed based only on the type of malware detected.

4. An ____ is a predetermined set of instructions for responding to specific types of security incidents.

5. The process of identifying and analyzing a security incident is called ____.

6. Which containment strategy is most appropriate for a suspected data exfiltration?

7. What is the primary purpose of a post-incident review or lessons learned session?

8. True or False: Incident response playbooks should only be accessible to the security team.

9. Which metric is most important for measuring incident response effectiveness?

10. During an incident, who should be notified according to a typical playbook?

11. Which phase of incident response focuses on stopping the attacker's activity and limiting damage?

12. True or False: Chain of custody procedures are essential during evidence collection in incident response.

13. Which type of playbook addresses responses to ransomware attacks?

14. What should be documented during the detection phase of incident response?

15. Which role is responsible for coordinating the overall incident response effort?

16. True or False: A playbook should be static and never updated after initial creation.

17. What is the goal of the recovery phase in incident response?

18. Which communication channel should be used first when reporting a critical incident to leadership?

19. During the eradication phase, what action is most critical?

20. What is the primary purpose of an incident response playbook?