A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an…

Determining the systems involved and deploying available patches directly addresses the recovery phase objective of returning systems to normal, secure operation. Patching closes the vulnerability exploited by the macro-enabled RCE attack, preventing reinfection after systems are brought back online.

Analyzing event logs and restricting network access are detection and containment activities that occur earlier in the incident response lifecycle, not during recovery.

Reviewing access lists and requiring password complexity changes are post-incident hardening actions belonging to the lessons-learned phase, not the recovery phase.

Identifying the attack vector and updating IDS signatures are analysis and improvement steps belonging to the detection and post-incident phases, not the recovery phase.