An organization suffered a security breach in which the attacker exploited a Netlogon Remote Protocol vulnerability for further privilege escalation. Which two actions should the incident response…

Question

Options

• ADefine roles and responsibilities in the incident response playbook.
• BAutomate antivirus scans of the company servers.
• CApply existing patches to the company servers.
• DImplement a patch management process.
• EScan the company server files for known viruses.

• A
  2% (1)
• B
  12% (5)
• C
  78% (32)
• D
  5% (2)
• E
  2% (1)

Explanation

Applying existing patches (C) directly remediates the Netlogon vulnerability (CVE-2020-1472, "Zerologon"), which Microsoft released a patch for - meaning the breach was preventable had that patch been deployed. Since the question asks for two answers and D is the logical companion, implementing a patch management process (D) addresses the systemic gap that allowed an unpatched vulnerability to persist in the first place: one fixes the immediate problem, the other prevents recurrence.

Why the distractors are wrong:

• A - Defining IR playbook roles is a post-incident organizational step, not a technical control that prevents vulnerability exploitation.
• B & E - Antivirus scans target malware signatures; the Netlogon exploit is a protocol-level authentication bypass, not a virus, so AV would not detect or prevent it.

Memory tip: When an attack exploits a known, patchable vulnerability, the two-part answer is almost always "apply the specific patch" + "build a process so it never goes unpatched again." Think: fix now (C) → fix the system that failed (D).

No community discussion yet for this question.