Question

A CySA+ analyst is helping the security team improve its preparation-phase readiness after a recent malware outbreak required lengthy, manual host rebuilds. During eradication, technicians rebuilt each infected workstation by hand, leading to inconsistent configurations and a recovery window that stretched into days. Which preparation activity would MOST directly reduce recovery time and configuration inconsistency during future incidents?

Accepted Answer

Establish and maintain validated golden images (known-good baseline builds) for rapid reimaging

Answer

Increase the frequency of authenticated vulnerability scans against the workstation fleet

Answer

Deploy additional EDR sensors to shorten mean time to detect on endpoints

Answer

Expand the SIEM correlation ruleset to catch the malware family earlier