lab 29

Question 1

The online malware hash analysis provided what result?

The file associated with the hash is a rootkit.

The file associated with the hash is a keystroke logger.

The file associated with the hash is unknown or is not known to be malware.

The file associated with the hash is ransomware.

Answer 1

The file associated with the hash is unknown or is not known to be malware.

Question 2

Which of the following playbook tasks must occur before the others?

Remove the suspicious file from the affected system(s).
Perform an online malware analysis using the hash value of the suspicious file.
Copy the zip archive of the suspicious file to a quarantine system.
Determine the rogue process’s name.

Answer 2

Determine the rogue process’s name.

Question 3

What asset defines the steps needed to respond to a security incident, such as the specific roles, processes, and procedures that security staff must follow?

User Acceptance Policy
Playbook
Non-Disclosure Agreement
Runbook

Answer 3

Playbook

Question 4

A playbook is often considered what type of security control?

Responsive
Preventive
Detective
Deterrent

Answer 4

Responsive

Question 5

What security solution scans security and threat intelligence data collected from multiple sources within the enterprise, then analyzes it using various techniques, and may trigger responses to take corrective action against discovered security violations?

NGFW
SIEM
SOAR
UEBA

Answer 5

SOAR

Question 6

Which of the following are true statements in regard to playbooks? (Select all that apply)

The most effective incident response playbooks are tailored to an organization’s specific security needs.

When creating an incident response playbook, organizations should ensure they have the right level of detail and that all necessary stakeholders are involved.

Generally, a playbook is used by a person, and a runbook is used by a SOAR platform in response to an incident or alert.

A playbook is designed to automate some of the routine tasks ordinarily performed by security personnel in response to a security incident.

Answer 6

When creating an incident response playbook, organizations should ensure they have the right level of detail and that all necessary stakeholders are involved.

Generally, a playbook is used by a person, and a runbook is used by a SOAR platform in response to an incident or alert.

A playbook is designed to automate some of the routine tasks ordinarily performed by security personnel in response to a security incident.