A security analyst has just received an incident ticket regarding a ransomware attack. Which of the following would most likely help an analyst properly triage the ticket?

Question

Options

• AIncident response plan
• BLessons learned
• CPlaybook
• DTabletop exercise

• A
  3% (1)
• B
  8% (3)
• C
  73% (29)
• D
  18% (7)

Explanation

Playbook (C) is the Best Answer

A playbook is the correct answer because it provides specific, step-by-step procedures for responding to a particular type of incident - in this case, ransomware - giving the analyst a structured, actionable guide to quickly and accurately triage the ticket. While an incident response plan (A) provides a broad, high-level framework for handling incidents generally, it lacks the granular, scenario-specific steps needed to triage a ransomware event effectively. Lessons learned (B) are retrospective documents created after an incident is resolved, making them useful for future improvement but not for active triage. A tabletop exercise (D) is a preparedness simulation used for training purposes, not a reference tool during a live incident.

Memory Tip: Think of a playbook like a sports team's play-by-play strategy - it tells you exactly what to do in a specific situation. When you see words like "triage," "specific incident type," or "step-by-step response," think Playbook!

No community discussion yet for this question.