Câu 6: 350-201: Performing CyberOps Using Core Security Technologies (CBRCOR)

An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

1. A. Host a discovery meeting and define configuration and policy updates
2. B. Update the IDS/IPS signatures and reimage the affected hosts — đáp án hiện tại
3. C. Identify the systems that have been affected and tools used to detect the attack
4. D. Identify the traffic with data capture using Wireshark and review email filters