CAS-005 · Question #418
After investigating a recent security incident, a SOC analyst is charged with creating a reference guide for the entire team to use. Which of the following should the analyst create to address…
The correct answer is C. Runbook. A runbook is a step-by-step procedural guide that SOC analysts reference during live incidents. It documents the specific actions to take, such as how to triage alerts, gather forensic artifacts, escalate issues, and contain threats, ensuring consistency and speeding up…
Question
After investigating a recent security incident, a SOC analyst is charged with creating a reference guide for the entire team to use. Which of the following should the analyst create to address future incidents?
Options
- ARoot cause analysis
- BCommunication plan
- CRunbook
- DLessons learned
How the community answered
(29 responses)- A3% (1)
- B3% (1)
- C86% (25)
- D7% (2)
Explanation
A runbook is a step-by-step procedural guide that SOC analysts reference during live incidents. It documents the specific actions to take, such as how to triage alerts, gather forensic artifacts, escalate issues, and contain threats, ensuring consistency and speeding up response times across the team.
Community Discussion
No community discussion yet for this question.