Security Operations Playbook Assessment

The video tutorial by Toby from Alline Security covers the use of playbooks in security PL 701 labs. It explains what a playbook is and demonstrates how to execute it using different methods like GUI, CLI, and third-party tools. The tutorial walks through steps such as investigating high CPU usage, terminating processes, hashing files, performing malware analysis, archiving files, transferring them to quarantine, and finally removing suspicious files. It concludes with creating an after-action report and emphasizes the importance of playbooks in guiding security analysts through incident response processes.

What is the primary purpose of a playbook in security operations?

• To document all network traffic

• To provide a step-by-step process for resolving incidents

• To automate all security tasks

• To replace security analysts

Which tool was used first to identify the high CPU usage process?

• Process Explorer

• Task Manager

• Command Prompt

• PowerShell

What was the name of the process causing high CPU usage?

• HeavyLoad

• LightLoad

• CPUHog

• MemoryEater

Which command is used in the command prompt to list all running processes?

• tasklist

• ps

• showproc

• listproc

What is the purpose of hashing a file in the context of this lab?

• To analyze the file for malware

• To identify the file's owner

• To verify the file's integrity

• To encrypt the file

Which online tool was used to analyze the malware hash?

• McAfee

• Norton

• MalwareBytes

• VirusTotal

Who was identified as the owner of the suspicious file?

• Admin

• Guest

• Root

• User

Which program was used to copy the archived file to a quarantine system?

• Cyberduck

• PuTTY

• FileZilla

• WinSCP

What is the final step in the playbook process?

• Analyzing the malware

• Creating the after-action report

• Removing the suspicious file

• Archiving the file

What is another name for the after-action report?

• Threat Analysis

• Lessons Learned

• Security Summary

• Incident Report