In incident response, a runbook typically contains step-by-step actions to restore services.

• A. Change log
• B. Ticket template
• C. Knowledge base article
• D. Runbook

Answer: (A)

In incident response, a runbook serves as the actionable guide that lists the exact sequence of steps to restore services. It includes the specific actions to take, the order to perform them, required tools or inputs, verification checks to confirm restoration, roles and responsibilities, escalation paths, and rollback or contingency steps. This makes the response repeatable, fast, and consistent under pressure, helping teams coordinate and recover more reliably.

Why the other options don’t fit as the step-by-step recovery guide: a change log records what was changed and when, not how to restore services; a ticket template is a form for capturing incident details in a tracking system; a knowledge base article provides general information or troubleshooting guidance, not a defined, executable remediation sequence.