In incident response, what is the purpose of Playbooks?

• A. To log network traffic
• B. To store encrypted keys
• C. To provide predefined, repeatable incident response procedures
• D. To perform automated threat hunting

Answer: (C)

Playbooks are predefined, repeatable incident response procedures that guide responders through the steps to detect, contain, eradicate, and recover from security incidents. They codify roles, actions, decision points, and communication so responses are consistent and fast, reducing delays and human error. While automation can implement parts of these steps, the core purpose is to standardize how incidents are handled across different situations. They are not primarily about logging network traffic, storing encrypted keys, or conducting automated threat hunting, which are covered by other tools and processes.