Câu 224: SY0-501: CompTIA Security+

Multiple employees receive an email with a malicious attachment that begins to encrypt their hard drives and mapped shares on their devices when it is opened. The network and security teams perform the following actions: ✑ Shut down all network shares. ✑ Run an email search identifying all employees who received the malicious message. ✑ Reimage all devices belonging to users who opened the attachment.Next, the teams want to re-enable the network shares. Which of the following BEST describes this phase of the incident response process?

1. A. Eradication
2. B. Containment
3. C. Recovery — đáp án hiện tại
4. D. Lessons learned