Describe the purpose of a runbook in incident response and give an example of a step.

• A. A budget plan
• B. A detailed, repeatable set of actions; example: isolate affected host from network and capture a memory dump
• C. A theoretical guide for attackers
• D. A user training manual

Answer: (B)

A runbook in incident response is a detailed, repeatable set of actions that responders follow to contain, analyze, and recover from an incident. It standardizes how to respond so the team can move quickly and consistently, even under pressure, and it helps ensure evidence is collected properly and actions are documented for later review. In practice, a runbook often includes clear steps, required tools, roles, communication plans, and escalation paths, and it can be automated where possible to speed execution.

An example step would be to isolate the affected host from the network to prevent further spread and exfiltration, while simultaneously capturing a memory dump to preserve volatile data for forensic analysis. Memory dumps reveal running processes, network connections, and in-memory credentials, which are critical for understanding how the incident unfolded and guiding remediation.

Budget plans, theoretical guides for attackers, or user training manuals aren’t the purpose of a runbook because they don’t provide the structured, repeatable actions used during active incident response.