.Question 2A security team is considering what they learned during past security incidents. They also discuss ways to improve their security posture and refine response strategies for future incidents. What is the security team’s goal in this scenario?1 pointUpdate a playbookAssess employee performanceEducate clientsDelete biometric data

Fill in the blank: A security team _____ their playbook frequently by learning from past security incidents, then refining policies and procedures.1 pointshortensupdatessummarizesoutlines

Question 2What does a security team do when updating and improving a playbook? Select all that apply.1 pointConsider learnings from past security incidentsDiscuss ways to improve security postureImprove antivirus software performanceRefine response strategies for future incidents

Question 1Playbooks are permanent, best-practice documents, so a security team should not make changes to them.1 pointTrueFalse2.Question 2A business recently experienced a security breach. Security professionals are currently restoring the affected data using a clean backup that was created before the incident. What playbook phase does this scenario describe?1 pointContainmentPost-incident activityDetection and analysisEradication and recovery3.Question 3Fill in the blank: Once a security incident is resolved, security analysts perform various post-incident activities and _____ efforts with the security team. 1 pointeradicationcoordinationpreparationdetection4.Question 4Which action can a security analyst take when they are assessing a SIEM alert?1 pointAnalyze log data and related metricsIsolate an infected network systemRestore the affected data with a clean backupCreate a final report

4.Question 4A security analyst wants to ensure an organized response and resolution to a security breach. They share information with key stakeholders based on the organization’s established standards. What phase of an incident response playbook does this scenario describe? 1 pointCoordinationDetection and analysisContainmentEradication and recovery

Question 3In which incident response playbook phase would a security team document an incident to ensure that their organization is better prepared to handle future security events?1 pointCoordinationEradication and recoveryContainmentPost-incident activity