Which Should a SOC Use to Improve Incident Response Procedure?
Short answer
A Playbooks
Question
Key Takeaways
The exam tests the distinction between playbooks (specific step-by-step procedures) and frameworks (general structures), with playbooks being the direct answer to improving procedures.
In the SY0-701 exam, playbooks are the correct answer for improving a SOC's incident response procedure because they provide step-by-step instructions. The community overwhelmingly supports playbooks, clarifying their role as specific procedural guides.
Common mistake: Choosing B. Frameworks is common because they provide incident response structure, but they are not as specific as playbooks, which directly outline steps for a given incident.
Expert Analysis
Why the Answer Is Correct
Playbooks are essential for an SOC because they provide detailed, step-by-step procedures for responding to specific incident types. This aligns with the community comment stating they are 'a step by step procedure outlining how to respond to specific types of incidents.' By using playbooks, analysts can act quickly and consistently, reducing errors and improving response time.
Why the Other Options Are Wrong
Frameworks (B) provide the overall architecture and high-level phases for incident response but lack the detailed, prescriptive steps needed for a single procedure. Baselines (C) and benchmarks (D) are security configuration references, not procedural response tools. Therefore, they do not directly improve the incident response procedure itself.
Community Comment Notes
Most comments support A, with one remark highlighting playbooks as step-by-step guides. A dissenting comment chose B, but this reflects a common misunderstanding of the difference between a framework and a playbook. The expert consensus and exam objectives clearly point to playbooks as the correct answer for improving procedures.
Official Reference
- https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
- https://attack.mitre.org/
- https://www.sans.org/white-papers/incident-handling/
These links open the official vendor documentation in a new tab.
Exam Strategy
When answering incident response questions, look for keywords like 'procedure' or 'step-by-step'—these almost always point to playbooks. Remember that frameworks are broader and provide structure, while playbooks are the specific actionable recipes for incidents.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
jafyyy 👍 6A. Playbooks Its a step by step procedure outlining how to respond to specific types of incidents.
-
qacollin 👍 3 Answered AA. GPT
-
StringerBarksdale 👍 2The answer is B
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →