What is the purpose of an incident response playbook?

• A. To replace the incident response team
• B. To provide step-by-step, pre-approved actions for responders to follow during incidents, ensuring consistency and speed
• C. To log access attempts
• D. To document network devices

Answer: (B)

An incident response playbook provides a pre-planned, step-by-step set of actions for responders to follow during security incidents, written and pre-approved to ensure everyone acts in a consistent and fast way. It guides who to contact, what communications to send, when to escalate, and how to collect evidence, so the team can move through containment, eradication, and recovery efficiently and with less confusion under pressure. It complements the incident response team rather than replacing it, and it isn’t about logging access attempts or listing network devices—that information lives in logging systems and asset management, not in the playbook itself.