Question 1

In the event of a security incident, when would it be appropriate to refer to an incident response playbook?

Accepted Answer

Throughout the entire incident (CORRECT)

Question 2

Fill in the blank: During the _____ phase, security professionals use tools and strategies to determine whether a breach has occurred and to evaluate its potential magnitude.

Accepted Answer

detection and analysis (CORRECT)

Question 3

In which incident response playbook phase would a security team document an incident to ensure that their organization is better prepared to handle future security events?

Accepted Answer

Post-incident activity (CORRECT)

Question 4

What is the relationship between SIEM tools and playbooks?

Accepted Answer

They work together to provide a structured and efficient way of responding to security incidents. (CORRECT)

Question 5

Which statements are true about playbooks? Select three answers.

Accepted Answer

Playbooks ensure that people follow a consistent list of actions in a prescribed way, Playbooks are manuals that provide details about any operational action, Playbooks clarify what tools should be used to respond to security incidents. (CORRECT)

Question 6

Playbooks are permanent, best-practice documents, so a security team should not make changes to them.

Accepted Answer

False (CORRECT)

Question 7

A business recently experienced a security breach. Security professionals are currently restoring the affected data using a clean backup that was created before the incident. What playbook phase does this scenario describe?

Accepted Answer

Eradication and recovery (CORRECT)

Question 8

Fill in the blank: Once a security incident is resolved, security analysts perform various post-incident activities and _____ efforts with the security team.

Accepted Answer

coordination (CORRECT)

Question 9

Which action can a security analyst take when they are assessing a SIEM alert?

Accepted Answer

Analyze log data and related metrics (CORRECT)

Question 10

Which of the following statements accurately describe playbooks? Select three answers.

Accepted Answer

A playbook is an essential tool used in cybersecurity, A playbook can be used to respond to an incident, A playbook can be used to respond to an incident (CORRECT)

Question 11

What does a security team do when updating and improving a playbook? Select all that apply.

Accepted Answer

Discuss ways to improve security posture, Consider learnings from past security incidents, Refine response strategies for future incidents (CORRECT)

Question 12

Fill in the blank: Incident response playbooks outline processes for communication and ______ of a security breach.

Accepted Answer

documentation (CORRECT)

Question 13

What are the primary goals of the containment phase of an incident response playbook? Select two answers.

Accepted Answer

Prevent further damage, Prevent further damage (CORRECT)

Question 14

Reduce the immediate impact (CORRECT)

Accepted Answer

ANSWERS HERE

Question 15

A security analyst wants to set the foundation for successful incident response. They outline roles and responsibilities of each security team member. What phase of an incident response playbook does this scenario describe?

Accepted Answer

Preparation (CORRECT)

Question 16

In what ways do SIEM tools and playbooks help security teams respond to an incident? Select all that apply.

Accepted Answer

SIEM tools and playbooks work together to provide a structured way of responding to incidents, SIEM tools detect threats, SIEM tools alert the security team to potential problems. (CORRECT)

Question 17

An organization has successfully responded to a security incident. According to their established standards, the organization must share information about the incident to a specific government agency. What phase of an incident response playbook does this scenario describe?

Accepted Answer

Coordination (CORRECT)

Question 18

Why is the containment phase of an incident response playbook a high priority for organizations?

Accepted Answer

It helps prevent ongoing risks to critical assets and data. (CORRECT)

Question 19

Fill in the blank: During the post-incident activity phase, organizations aim to enhance their overall _____ by determining the incident’s root cause and implementing security improvements.

Accepted Answer

security posture (CORRECT)

Question 20

In what ways do SIEM tools and playbooks help security teams respond to an incident? Select all that apply.

Accepted Answer

SIEM alerts inform security teams of potential threats, SIEM tools analyze data, SIEM tools and playbooks work together to provide an efficient way of handling security incidents. (CORRECT)

Question 21

A security analyst reports to stakeholders about a security breach. They provide details based on the organization’s established standards. What phase of an incident response playbook does this scenario describe?

Accepted Answer

Coordination (CORRECT)

Question 22

Fill in the blank: During the post-incident activity phase, security teams may conduct a full-scale analysis to determine the _____ of an incident and use what they learn to improve the company’s overall security posture.

Accepted Answer

root cause (CORRECT)

Question 23

Which of the following statements accurately describe playbooks? Select three answers.

Accepted Answer

A playbook is a manual that provides details about any operational action, Organizations use playbooks to ensure employees follow a consistent list of actions, A playbook clarifies what tools to use in response to a security incident. (CORRECT)

Question 24

Fill in the blank: A security team _____ their playbook frequently by learning from past security incidents, then refining policies and procedures.

Accepted Answer

updates (CORRECT)

Question 25

Fill in the blank: Incident response is an organization’s quick attempt to _____ an attack, contain the damage, and correct its effects.

Accepted Answer

identify (CORRECT)

Question 26

Which phase of an incident response playbook is primarily concerned with preventing further damage and reducing the immediate impact of a security incident?

Accepted Answer

Containment (CORRECT)

Question 27

Fill in the blank: During the _____ phase, security teams may conduct a full-scale analysis to determine the root cause of an incident and use what they learn to improve the company’s overall security posture.

Accepted Answer

post-incident activity (CORRECT)

Question 28

A security analyst wants to ensure an organized response and resolution to a security breach. They share information with key stakeholders based on the organization’s established standards. What phase of an incident response playbook does this scenario describe?

Accepted Answer

Coordination (CORRECT)

Question 29

A security analyst establishes incident response procedures. They also educate users on what to do in the event of a security incident. What phase of an incident response playbook does this scenario describe?

Accepted Answer

Preparation (CORRECT)

COURSE 2 – PLAY IT SAFE: MANAGE SECURITY RISKS

Module 4: Use Playbooks to Respond to Incidents

GOOGLE CYBERSECURITY PROFESSIONAL CERTIFICATE

Coursera Study Guide

TABLE OF CONTENT

INTRODUCTION – Use Playbooks to Respond to Incidents

Learning Objectives

TEST YOUR KNOWLEDGE: INCIDENT RESPONSE

1. In the event of a security incident, when would it be appropriate to refer to an incident response playbook?

2. Fill in the blank: During the _____ phase, security professionals use tools and strategies to determine whether a breach has occurred and to evaluate its potential magnitude.

3. In which incident response playbook phase would a security team document an incident to ensure that their organization is better prepared to handle future security events?

4. What is the relationship between SIEM tools and playbooks?

5. Which statements are true about playbooks? Select three answers.

TEST YOUR KNOWLEDGE: USE A PLAYBOOK TO RESPOND TO AN INCIDENT

1. Playbooks are permanent, best-practice documents, so a security team should not make changes to them.

2. A business recently experienced a security breach. Security professionals are currently restoring the affected data using a clean backup that was created before the incident. What playbook phase does this scenario describe?

3. Fill in the blank: Once a security incident is resolved, security analysts perform various post-incident activities and _____ efforts with the security team.

4. Which action can a security analyst take when they are assessing a SIEM alert?

MODULE 4 CHALLENGE

1. Which of the following statements accurately describe playbooks? Select three answers.

2. What does a security team do when updating and improving a playbook? Select all that apply.

3. Fill in the blank: Incident response playbooks outline processes for communication and ______ of a security breach.

4. What are the primary goals of the containment phase of an incident response playbook? Select two answers.

5. A security analyst wants to set the foundation for successful incident response. They outline roles and responsibilities of each security team member. What phase of an incident response playbook does this scenario describe?

6. In what ways do SIEM tools and playbooks help security teams respond to an incident? Select all that apply.

7. An organization has successfully responded to a security incident. According to their established standards, the organization must share information about the incident to a specific government agency. What phase of an incident response playbook does this scenario describe?

8. Why is the containment phase of an incident response playbook a high priority for organizations?

9. Fill in the blank: During the post-incident activity phase, organizations aim to enhance their overall _____ by determining the incident’s root cause and implementing security improvements.

10. In what ways do SIEM tools and playbooks help security teams respond to an incident? Select all that apply.

11. A security analyst reports to stakeholders about a security breach. They provide details based on the organization’s established standards. What phase of an incident response playbook does this scenario describe?

12. Fill in the blank: During the post-incident activity phase, security teams may conduct a full-scale analysis to determine the _____ of an incident and use what they learn to improve the company’s overall security posture.

13. Which of the following statements accurately describe playbooks? Select three answers.

14. Fill in the blank: A security team _____ their playbook frequently by learning from past security incidents, then refining policies and procedures.

15. Fill in the blank: Incident response is an organization’s quick attempt to _____ an attack, contain the damage, and correct its effects.

16. Which phase of an incident response playbook is primarily concerned with preventing further damage and reducing the immediate impact of a security incident?

17. Fill in the blank: During the _____ phase, security teams may conduct a full-scale analysis to determine the root cause of an incident and use what they learn to improve the company’s overall security posture.

18. A security analyst wants to ensure an organized response and resolution to a security breach. They share information with key stakeholders based on the organization’s established standards. What phase of an incident response playbook does this scenario describe?

19. A security analyst establishes incident response procedures. They also educate users on what to do in the event of a security incident. What phase of an incident response playbook does this scenario describe?

Subscribe to our site

Quiztudy Top Courses

Popular in Coursera