Which of the following will the blue team do after detecting an loC?

exams SY0-601 V4 SY0-601 exam 0 Comments

An organization has hired a ted team to simulate attacks on its security posture.

Which of the following will the blue team do after detecting an loC?
A . Reimage the impacted workstations
B. Activate runbooks for incident response
C. Conduct forensics on the compromised system
D. Conduct passive reconnaissance to gather information

Answer: B