SY0-701 · Question #525
Which of the following is most likely to be used as a just-in-time reference document within a security operations center?
The correct answer is C. Playbook. A playbook is the correct answer because it is a structured, step-by-step operational guide that SOC analysts reference in real time when responding to specific incident types - exactly the kind of "just-in-time" document consulted during an active threat response. A (Change…
Question
Which of the following is most likely to be used as a just-in-time reference document within a security operations center?
Options
- AChange management policy
- BRisk profile
- CPlaybook
- DSIEM profile
How the community answered
(33 responses)- A3% (1)
- C91% (30)
- D6% (2)
Explanation
A playbook is the correct answer because it is a structured, step-by-step operational guide that SOC analysts reference in real time when responding to specific incident types - exactly the kind of "just-in-time" document consulted during an active threat response.
- A (Change management policy) is a governance document used to control and approve system modifications; it is not consulted during live incident response.
- B (Risk profile) describes an organization's overall risk posture and exposure - strategic context, not a procedural action guide.
- D (SIEM profile) refers to configuration or use-case profiles within a SIEM tool, not a reference document an analyst pulls up mid-incident.
Memory tip: Think of a playbook like a sports coach's play-by-play card - you grab it the moment the play starts, not before the season or after the game. "Just-in-time" = action steps = playbook.
Topics
Community Discussion
No community discussion yet for this question.