CompTIA Exam SY0-601 Topic 1 Question 85 Discussion

Actual exam question for CompTIA's SY0-601 exam

Question #: 85
Topic #: 1

An organization has hired a red team to simulate attacks on its security pos-ture, which Of following will the blue team do after detecting an IOC?

AReimage the impacted workstations.

BActivate runbooks for incident response.

CConduct forensics on the compromised system,

DConduct passive reconnaissance to gather information

Show Suggested Answer

Suggested Answer: B

A runbook is a set of predefined procedures and steps that guide an incident response team through the process of handling a security incident.It can help the blue team respond quickly and effectively to an indicator of compromise (IOC) by following the best practices and predefined actions for containment, eradication, recovery and lessons learned.

by Rickie at Jun 29, 2024, 02:29 AM

Limited Time Offer

25%

Off

Get Premium SY0-601 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Edison

5 months ago

I think conducting forensics on the compromised system is also important to understand the extent of the breach.

upvoted 0 times

...

Gwenn

5 months ago

I agree with Desiree, activating runbooks will help them respond quickly and effectively.

upvoted 0 times

...

Isadora

5 months ago

D) Conduct passive reconnaissance to gather information. Sounds like a good way to get caught with your pants down!

upvoted 0 times

Marlon

4 months ago

B) Activate runbooks for incident response.

upvoted 0 times

...

Joana

4 months ago

A) Reimage the impacted workstations.

upvoted 0 times

...

Desiree

5 months ago

I believe they should activate runbooks for incident response.

upvoted 0 times

...

Page

5 months ago

What do you think the blue team should do after detecting an IOC?

upvoted 0 times

...

Katina

5 months ago

A) Reimage the impacted workstations. Nah, gotta dig deeper and find the root cause first.

upvoted 0 times

...

Ira

5 months ago

B) Activate runbooks for incident response. Gotta get that incident response plan in motion, stat!

upvoted 0 times

Alexis

4 months ago

D) Conduct passive reconnaissance to gather information.

upvoted 0 times

...

Cheryll

4 months ago

C) Conduct forensics on the compromised system.

upvoted 0 times

...

Gail

4 months ago

B) Activate runbooks for incident response.

upvoted 0 times

...

Ming

4 months ago

A) Reimage the impacted workstations.

upvoted 0 times

...

Kallie

5 months ago

C) Conduct forensics on the compromised system. That's the logical next step after detecting an IOC.

upvoted 0 times

Frank

4 months ago

B) Activate runbooks for incident response.

upvoted 0 times

...

Stephanie

5 months ago

A) Reimage the impacted workstations.

upvoted 0 times

...

Erick

5 months ago

B) Activate runbooks for incident response.

upvoted 0 times

...

Jani

5 months ago

A) Reimage the impacted workstations.

upvoted 0 times

...