MENU
A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?
Suggested Answer: B
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
14 comments · newest first
LE
Leota
2 days ago
Honestly, I feel overwhelmed. So many steps to consider!
CA
Cassie
8 days ago
D makes sense too. Updating IDS signatures can catch similar threats.
EL
Eleonore
13 days ago
C is also important. Stronger passwords can stop unauthorized access.
GA
Galen
18 days ago
Agreed! But we can't ignore A. Patching is essential to prevent future attacks.
IV
Ivory
23 days ago
I think option B is crucial. Analyzing logs helps understand the breach.
ME
Merilyn
28 days ago
Restricting network access is key to prevent further damage.
BO
Bobbye
1 month ago
Wait, are we really sure it was a phishing email?
WI
William
1 month ago
Patching systems is a must, but what about user training?
VI
Vivan
1 month ago
I think updating the IDS signatures is crucial too!
AU
Audra
2 months ago
Definitely need to analyze event logs first.
KA
Karma
2 months ago
I recall that increasing password complexity is generally good, but I'm not sure if it directly relates to recovery from this type of attack. Option C feels a bit off to me.
MA
Marshall
2 months ago
I think we practiced a similar question where we had to determine the systems involved first. So, option A seems like a logical step to take.
ST
Stephanie
2 months ago
I'm a bit unsure about the recovery steps, but I feel like identifying the attack vector is important. Maybe option D is the right choice?
RO
Rodney
2 months ago
I remember we discussed the importance of analyzing event logs in our last practice session, so I think option B might be crucial here.