Exam 350-201 topic 1 question 28 discussion

Guys I took the exam and failed today. All the questions are here but the answers are wrong.

ChatGPT: During the recovery stage of the incident response process, the focus is on restoring affected systems to a secure state and preventing reinfection.

I would go with A

correct answer is A 100%

Since it is at recovery stage. correct Answer is A

similar test question except the action required to prevent

At the recovery stage of an incident where a remote code execution attack has occurred in a company's infrastructure after a phishing email was used to deliver a file with an embedded macro, the following step should be taken: A. Determine the systems involved and deploy available patches. After an incident, it is essential to determine the scope of the attack, including which systems were involved and the extent of the damage. In this case, the first step in the recovery process should be to identify the affected systems and deploy available patches to prevent the attack from recurring and to address any vulnerabilities that were exploited. Other answers also important steps in responding to the incident, but they are not specific to the recovery stage. These steps can be taken earlier in the incident response process to help identify and contain the attack, but at the recovery stage, the focus is on restoring affected systems and preventing the attack from recurring. - ChatGPT

A - Recovery

We talk about recovery. Correct answer is A.

The most common attack vectors include malware, viruses, email attachments, web pages, pop-ups, instant messages, text messages, and social engineering. However, the number of cyber threats continues to grow as cybercriminals look to exploit unpatched or zero-day vulnerabilities listed on CVE and the dark web, as there is no single solution for preventing every attack vector.

A -100%.

So for this question we need to know what happens in the NIST "recovery" stage: In recovery, administrators restore systems to normal operation, confirm that the systems are functioning normally, and (if applicable) remediate vulnerabilities to prevent similar incidents. Recovery may involve such actions as restoring systems from clean backups, rebuilding systems from scratch, replacing compromised files with clean versions, installing patches, changing passwords, and tightening network perimeter security (e.g., firewall rulesets, boundary router access control lists). Although the answer seen here is B, I also believe the answer is A.

I think A is the correct answer.