A comprehensive playbook addresses which phases of incident response? (Choose two)

Question

Options

• ADetection
• BBudget planning
• CRecovery
• DLunch break scheduling

• A
  88% (22)
• B
  8% (2)
• D
  4% (1)

Explanation

A comprehensive incident response playbook covers Detection (A) and Recovery (C) because these are core phases of the incident response lifecycle - playbooks guide teams on how to identify threats and how to restore systems after an incident. Detection encompasses monitoring, alerting, and confirming that an incident has occurred, while Recovery involves restoring affected systems, validating integrity, and returning to normal operations.

Why the distractors are wrong:

• B (Budget planning) is an organizational/administrative function that happens outside the incident lifecycle - it's handled by management, not a response playbook.
• D (Lunch break scheduling) is a nonsense distractor; playbooks address technical and procedural steps, not personnel scheduling.

Memory tip: Think of a playbook as a "find it, fix it" guide - it helps you detect the problem and recover from it. If the choice sounds like a business administration task rather than a hands-on response action, eliminate it.

No community discussion yet for this question.