Question 42

C is most likely to be used as a just-in-time reference document within a security operations center.

A playbook serves as an essential resource providing step-by-step procedures for responding to various security incidents. Its design allows quick access to information, making it ideal for just-in-time reference in high-pressure situations.

A) Change management policy

While a change management policy is crucial for guiding how changes to IT services are handled, it does not serve as an immediate reference for responding to security incidents. It is more focused on the processes surrounding change implementation rather than providing direct, actionable responses to incidents.

B) Risk profile

A risk profile outlines potential risks and vulnerabilities within a system, but it does not provide specific instructions for immediate action. It is more useful for strategic planning and risk assessment rather than serving as a quick reference for incident response.

C) Playbook

The playbook is specifically designed for operational use within a security operations center, detailing responses to various incidents. Its structured format allows security personnel to quickly reference procedures and protocols, making it the most suitable option for just-in-time documentation.

D) SIEM profile

A SIEM (Security Information and Event Management) profile contains information related to security event monitoring and analysis, but it is not structured as a quick reference guide for incident response. It supports ongoing security operations rather than providing immediate, actionable steps for dealing with incidents.

Conclusion

The playbook stands out as the most appropriate just-in-time reference document for a security operations center due to its practical, action-oriented nature. In contrast, the other options focus on broader policy, risk assessment, or monitoring rather than providing the immediate guidance needed during security incidents.