Exam SY0-601 topic 1 question 631 discussion

Actual exam question from CompTIA's SY0-601

Question #: 631
Topic #: 1

The SOC is reviewing processes and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarantining an infected host was the best course of action. This allowed the malware to spread to additional hosts before it was contained. Which of the following would be BEST to improve the incident response process?

A. Updating the playbooks with better decision points
B. Dividing the network into trusted and untrusted zones
C. Providing additional end-user training on acceptable use
D. Implementing manual quarantining of infected hosts

Show Suggested Answer

Suggested Answer: A 🗳️

by sujon_london at Sept. 5, 2023, 7:10 p.m.

Comments

Submit Cancel

sujon_london

Highly Voted 1 year, 9 months ago

Selected Answer: A

Updating the playbooks with better decision points will help the SOC team to make quicker and more informed decisions during an incident. This will help to contain the incident and minimize the damage.

upvoted 5 times

...

shady23

Most Recent 1 year, 1 month ago

Selected Answer: A

A. Updating the playbooks with better decision points

upvoted 1 times

...

ComPCertOn

1 year, 7 months ago

Selected Answer: A

Only one makes sense

upvoted 2 times

...