An alert for malware propagation triggers an incident. The associated playbook isolates the endpoint and notifies the SOC team. What advantages does this approach provide? (Choose two)

Question

Options

• AReduces mean time to respond (MTTR)
• BPrevents SOC teams from seeing alert metadata
• CAutomates critical response actions
• DAllows unrestricted user activity

• A
  87% (34)
• B
  8% (3)
• D
  5% (2)

Explanation

Using a playbook that automatically isolates the endpoint and notifies the SOC team directly reduces MTTR (A) because the response begins immediately without waiting for manual intervention - seconds matter when malware is spreading. It also automates critical response actions (C), turning a repeatable, time-sensitive task into a consistent, codified workflow that doesn't rely on human memory under pressure.

B is wrong because playbooks typically increase SOC visibility by logging actions and surfacing alert metadata - not hiding it. D is wrong because isolating the endpoint is the opposite of unrestricted activity; containment is the core purpose of the playbook.

Memory tip: Think of a playbook like a fire sprinkler system - it triggers automatically (automates actions = C), puts out the fire faster than waiting for firefighters (reduces MTTR = A), and definitely doesn't let people keep doing whatever they want during a fire (eliminating D). The sprinkler also alerts the fire department, not blinds them (eliminating B).

No community discussion yet for this question.