CompTIA Security+ Certification Exam SY0-701 Practice Test 21 Flashcards
Which of the following terms refers to the use of technology to perform individual tasks with minimal human intervention?
A) Automation
B) Scripting
C) Orchestration
D) Sequencing
A) Automation
Which of the terms listed below refers to a process that deals with coordinating and managing multiple repetitive tasks?
A) Sequencing
B) Orchestration
C) Scripting
D) Automation
B) Orchestration
Which of the following technologies enables automated handling of multiple security incidents?
A) SOAP
B) SASE
C) SOAR
D) SIEM
C) SOAR
A checklist of actions that can be performed in response to a security incident is known as a:
A) Runbook
B) Template
C) Playbook
D) Script
C) Playbook
Which of the terms listed below refers to a term that describes an exact sequence of steps, including both manual and automated actions, to be taken in response to a specific security incident?
A) Runbook
B) Script
C) Template
D) Playbook
A) Runbook
Which of the following answers refers to a set of rules, policies, or automated controls designed to regulate technology-related decisions and actions within an organization?
A) Technical standards
B) Compliance requirements
C) Guardrails
D) Security baselines
C) Guardrails
Which of the answers listed below refers to a term primarily used in software development to describe the cost of short-term decisions that can lead to long-term problems?
A) Code entropy
B) Exposure factor
C) Risk register
D) Technical debt
D) Technical debt
Which part of the incident response process involves establishing and maintaining the incident response capability as well as setting up an incident response team?
A) Preparation
B) Detection and analysis
C) Containment, eradication, and recovery
D) Post-incident activity
A) Preparation
In the incident response process, the step that involves identifying and understanding potential incidents to determine their scope, impact, and root cause is a part of the:
A) Preparation stage
B) Detection and analysis stage
C) Containment, eradication, and recovery stage
D) Post-incident activity stage
B) Detection and analysis stage
Which of the following answers refer(s) to the containment, eradication, and recovery stage of the incident response process? (Select all that apply)
A) Restoring normal operations
B) Eliminating the threat
C) Monitoring and detecting potential incidents
D) Establishing and maintaining an incident response policy
E) Mitigating the impact of the incident
A) Restoring normal operations
B) Eliminating the threat
E) Mitigating the impact of the incident
Which stage of the incident response process involves updating incident response plans, policies, and procedures?
A) Preparation
B) Detection and analysis
C) Containment, eradication, and recovery
D) Post-incident activity
D) Post-incident activity
Which of the answers listed below refers to a discussion-based activity where team members walk through different scenarios to evaluate the incident response plan without activating any systems?
A) Tabletop exercise
B) Simulation
C) Threat hunting
D) Root cause analysis
A) Tabletop exercise
Which of the following answers refers to a more in-depth exercise, which can include activating systems and performing real actions to respond to the incident?
A) Penetration testing
B) Threat hunting
C) Simulation
D) Vulnerability scanning
C) Simulation
During the post-incident activity stage, this step involves analyzing logs, forensics data, and other evidence to prevent incident reoccurrence.
A) Reporting
B) E-discovery
C) Root cause analysis
D) Threat hunting
C) Root cause analysis
The term “Threat hunting” refers to a proactive search for IoC to identify and address potential threats and vulnerabilities before they can escalate into full-blown incidents.
A) True
B) False
A) True
