Exam 350-201 topic 1 question 17 discussion

B. Update the IDS/IPS signatures and reimage the affected hosts. The recovery phase is focused on restoring the organization's systems and services to a normal state. After a phishing attack, it is essential to address any vulnerabilities that the attackers exploited to prevent future attacks. Updating the IDS/IPS signatures can help to identify similar attacks in the future. Reimaging the affected hosts can help to ensure that any malware or other malicious software that may have been installed during the attack is removed. A. Hosting a discovery meeting and defining configuration and policy updates, C. Identifying the systems that have been affected and tools used to detect the attack, and D. Identifying the traffic with data capture using Wireshark and reviewing email filters are all important steps in the incident response process after a phishing attack, but they are not specifically related to the recovery phase of the process. These steps are typically taken during the investigation phase of the incident response process, which precedes the recovery phase.

When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring (e.g., what tools or attack methods are being used, what vulnerabilities are being exploited). The initial analysis should provide enough information for the team to prioritize subsequent activities, such as containment of the incident and deeper analysis of the effects of the incident.

Update the IDS/IPS signatures and reimage the affected hosts

Its B for sure its remediation part !!!

Although reimaging is done in recovery, updating IPS has littlte to no affect on phishing. Phishing is detected in emails and very few times through IPS. IPS = Containment. To recover you will need to identy affected hosts, how, with tools like CES you can see who receive the phishing attack and even identify who clicked a link. During ERADICATION, it is important to IDENTIFY ALL AFFECTED HOSTS within the organization so that they can be remediated. For some incidents, ERADICATION is either not necessary or is performed DURING recovery. I think C is correct

100% B

I think B is the correct answer.