Câu 32: CAS-005: CompTIA SecurityX

An incident response team completed recovery from offline backup for several workstations. The workstations were subjected to a ransomware attack after users fell victim to a spear-phishing campaign, despite a robust training program. Which of the following questions should be considered during the lessons-learned phase to most likely reduce the risk of reoccurrence? (Choose two.)

1. A. Are there opportunities for legal recourse against the originators of the spear-phishing campaign?
2. B. What internal and external stakeholders need to be notified of the breach?
3. C. Which methods can be implemented to increase speed of offline backup recovery?
4. D. What measurable user behaviors were exhibited that contributed to the compromise? — đáp án hiện tại
5. E. Which technical controls, if implemented, would provide defense when user training fails? — đáp án hiện tại
6. F. Which user roles are most often targeted by spear phishing attacks?