Incident Response and Forensics CISA Practice Questions (Page 9)

Questions 41–41

1. 41application · medium

   A financial services firm has just experienced a ransomware attack that encrypted critical file servers. The incident response team followed the playbook, contained the spread, and eradicated the malware. Before restoring from backups, the team wants to ensure the same vulnerability cannot be exploited again. Which phase of the incident response lifecycle should the team formally execute next to address this concern?

   • ADetection
   • BContainment
   • CLessons Learned
   • DRecovery
   Reveal Solution Discussion Select an answer first