Câu 37: SY0-601: CompTIA Security+ 2021

An organization has activated an incident response plan due to a malware outbreak on its network. The organization has brought in a forensics team that has identified an internet-facing Windows server as the likely point of initial compromise. The malware family that was detected is known to be distributed by manually logging on to servers and running the malicious code. Which of the following actions would be BEST to prevent reinfection from the infection vector?

1. A. Prevent connections over TFTP from the internal network.
2. B. Create a firewall rule that blocks a 22 from the internet to the server.
3. C. Disable file sharing over port 445 to the server.
4. D. Block port 3389 inbound from untrusted networks. — đáp án hiện tại