Q8
Single choice
An incident at a government agency has occurred and the following actions were taken:
1. Users have regained access to email accounts
2. Temporary VPN services have been removed
3. Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated
4. Temporary email servers have been decommissioned
Which of the following phases of the incident response process match the actions taken?