A Threat Actor Used a Phishing Email to Deliver a File

Multiple Choice

A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?

A) Determine the systems involved and deploy available patches
B) Analyze event logs and restrict network access
C) Review access lists and require users to increase password complexity
D) Identify the attack vector and update the IDS signature list