MENU
A security team received reports of users receiving emails linked to external or unknown URLs that are non- returnable and non-deliverable. The ISP also reported a 500% increase in the amount of ingress and egress email traffic received. After detecting the problem, the security team moves to the recovery phase in their incident response plan. Which two actions should be taken in the recovery phase of this incident? (Choose two.)
Suggested Answer: A
Get Premium 300-215 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
28 comments · newest first
JO
Jovita
11 months ago
I think scanning hosts should be prioritized too.
VI
Viola
11 months ago
Wow, a 500% increase? That's insane!
YA
Yaeko
11 months ago
Not sure if removing vulnerabilities is the right move right now...
BR
Brinda
11 months ago
Collecting logs is a must!
VE
Veronica
12 months ago
Gotta verify the breadth of the attack first!
BE
Bea
12 months ago
I feel like requesting packet capture could provide valuable insights, but I can't recall if it fits into the recovery phase specifically.
RO
Roxanne
1 year ago
I'm a bit confused about whether we should focus on removing vulnerabilities or scanning hosts first. They both seem important.
KR
Kristian
1 year ago
I remember a practice question where collecting logs was emphasized as a key action. It seems like it would help understand the scope of the issue.
OC
Octavio
1 year ago
I think verifying the breadth of the attack is crucial, but I'm not entirely sure if that's the best first step in recovery.
PE
Peggie
1 year ago
I've got this! Verifying the breadth of the attack and collecting logs are the two actions I would take in the recovery phase. Gotta gather all the evidence to understand what happened and how to prevent it in the future.
CI
Ciara
1 year ago
Okay, let's think this through. Verifying the breadth of the attack and collecting logs are definitely important to assess the situation. Removing vulnerabilities could also be a good step to prevent further incidents.
TA
Tamesha
1 year ago
Hmm, I'm a bit unsure about this one. I think collecting logs and requesting packet capture would be key to investigate the incident, but I'm not sure about the other options.
NA
Nana
1 year ago
This question seems straightforward. I'd focus on verifying the breadth of the attack and collecting logs to understand the scope and impact.
GE
Gerry
1 year ago
Removing vulnerabilities is definitely important, but I think it should come a little later in the process. First, they need to get a handle on the situation and contain the damage.
DO
Dominga
1 year ago
Requesting packet capture can also help in analyzing the traffic and identifying any malicious activity.
DO
Dominga
1 year ago
I agree, verifying the breadth of the attack and collecting logs should be the first steps to understand the extent of the incident.
AL
Alberta
1 year ago
Haha, I bet the IT guys are pulling their hair out trying to keep up with that 500% increase in email traffic. Crazy stuff!
MY
Myrtie
2 years ago
Requesting packet capture is a great idea too. That data could give the security team valuable insights into the attack vector and help them plug any holes.
NE
Nelida
1 year ago
C) request packet capture
CH
Chaya
1 year ago
Requesting packet capture is a great idea too. That data could give the security team valuable insights into the attack vector and help them plug any holes.
MA
Maryann
1 year ago
B) collect logs
TW
Twana
1 year ago
A) verify the breadth of the attack
MO
Moon
2 years ago
Verifying the breadth of the attack and collecting logs seem like the obvious next steps to me. Can't really recover from an incident without understanding the full scope of the problem.
WI
Wilford
1 year ago
B) collect logs
JA
Janella
1 year ago
A) verify the breadth of the attack
CO
Corinne
2 years ago
After that, we should scan hosts with updated signatures to ensure we have addressed all vulnerabilities.
JA
Jaleesa
2 years ago
I agree with Mattie. We also need to collect logs to understand the extent of the incident.
MA
Mattie
2 years ago
I think we should verify the breadth of the attack first.