Privilege escalation can occur if authorization is granted without proper authentication, allowing a user to gain higher-level access than intended.

RTO is the maximum acceptable downtime: the target window within which systems and operations must be restored after a disruption. When the team asks "how long until we're back up?", they're defining the RTO.

A playbook is a documented set of procedures that outlines the step-by-step response to specific types of cybersecurity incidents. Security Operations Centers (SOCs) use playbooks to improve consistency, efficiency, and accuracy during incident response. Playbooks help ensure that the correct procedures are followed based on the type of incident, ensuring swift and effective remediation.
* Frameworks provide general guidelines for implementing security but are not specific enough for incident response procedures.
* Baselines represent normal system behavior and are used for anomaly detection, not incident response guidance.
* Benchmarks are performance standards and are not directly related to incident response.

The scenario shows MD5 hashed password values. The most likely reason the security administrator is focusing on these values is to protect against pass-the-hash attacks. In this type of attack, an attacker can use a captured hash to authenticate without needing to know the actual plaintext password. By managing and monitoring these hashes, the administrator can implement strategies to mitigate this type of threat.