Exam CS0-002 topic 1 question 391 discussion

This isn't an incident response but vulnerability management. There's nothing mentioned in this question about an intrusion. A and F are the most appropriate.

A & E A - Patch the required hosts with the correct updates and hot fixes, and rescan them for vulnerabilities: The first step should be to patch the required hosts with the correct updates and hot fixes. This will address the identified vulnerabilities and reduce the risk of a successful attack. Once the patching is complete, the security team should rescan the hosts for vulnerabilities to ensure that the patches have been applied successfully. E - Harden the hosts on the network, as recommended by the NIST framework: In addition to patching the hosts, the security team should also consider hardening the hosts on the network as recommended by the National Institute of Standards and Technology (NIST) framework. Hardening involves implementing security measures such as disabling unnecessary services, changing default passwords, and configuring firewalls. These measures will further reduce the risk of a successful attack and improve the overall security posture of the hosts.

why containtmanet ? there is no incindent at this moment , we are not in kill chain mode. AF - these are rezolving the both issues - A -> hosts not updated now, and F -> update script not working

First step should be containment. SO B F

answer AF