300-215 Question 130
Select 3After a cybersecurity incident involving unauthorized access to a sensitive database, the incident response team has completed their analysis and presented their findings. As part of the post-incident review, which of the following actions should be recommended to improve the organization's security posture and reduce the likelihood of similar incidents in the future?
- A
Implement stricter access controls and role-based access policies for sensitive databases.
- B
Establish an incident response playbook and conduct regular tabletop exercises.
- C
Revert all system configurations to their state prior to the incident.
- D
Deploy endpoint detection and response (EDR) solutions across the organization.
- E
Disable all remote access capabilities to prevent unauthorized access.
Show answer and explanation
Correct answers: A, B, D
Explanation
Post-incident recommendations should focus on addressing the root cause of the incident, improving detection and response capabilities, and enhancing the organization's overall security posture. In this scenario, stricter access controls, an incident response playbook with regular exercises, and the deployment of EDR solutions directly align with these objectives, making them the appropriate actions to recommend.
- A. Correct.
Implementing stricter access controls and role-based policies is a critical step to minimize unauthorized access and ensure users only have access to necessary resources. This is a direct improvement based on the findings of the incident.
- B. Correct.
Establishing an incident response playbook and conducting regular exercises helps prepare the organization for future incidents, improving overall readiness and response times.
- C. Incorrect.
Reverting system configurations to their prior state does not address the root cause of the incident and could reintroduce vulnerabilities that were exploited during the breach.
- D. Correct.
Deploying endpoint detection and response (EDR) solutions enhances the organization's ability to detect and mitigate threats at the endpoint level, reducing the risk of similar incidents.
- E. Incorrect.
Disabling all remote access capabilities is impractical for most organizations and does not directly address the root cause of the incident. Instead, secure remote access solutions should be implemented.