Lena is performing an active email-containment measure by removing identified phishing messages before the mail server completes their delivery. ECIH v3 emphasizes rapid containment of phishing campaigns once malicious messages, links, senders, or indicators have been validated. Purging queued messages reduces the number of employees exposed to malicious links and therefore decreases the likelihood of additional credential compromise. SIEM correlation can help analyze the foreign login attempts, but it does not prevent pending malicious messages from reaching users. Forensic triage of attachments is inappropriate when the primary attack vector described is a malicious shared-drive link. Isolating individual mailboxes would also fail to address messages queued for broader delivery. Preemptively deleting the identified phishing emails from the mail queue therefore directly contains the campaign and limits its organizational impact.

================

James is working on the post-incident activities stage of the Incident Handling and Response (IH & R) process. After containing the spread of the infection and removing the malware, the focus shifts to assessing the impact of the incident on the organization and preparing a detailed report. This phase involves analyzing the extent of the damage, determining the cost of the attack, evaluating how well the incident was managed, and identifying lessons learned to improve future response efforts. The objective is to restore systems to normal operation, ensure no remnants of the threat remain, and implement measures to prevent recurrence.

Reducing the success rate of SQL injection attacks is focused on minimizing vulnerabilities within the application ' s database interactions, rather than the broader server or network services. SQL injection prevention techniques typically involve input validation, parameterized queries, and the use of stored procedures, rather than changes to the network or server configuration.

A) Closing unnecessary application services and ports on the server is a general security best practice to reduce the attack surface but does not directly impact the success rate of SQL injection attacks. This action limits access to potential vulnerabilities across the network and server but doesn ' t address the specific ways SQL injection exploits input handling within web applications.

B) Automatically locking a user account after a predefined number of invalid login attempts within a predefined interval can help mitigate brute force attacks but has no direct effect on preventing SQL injection, which exploits code vulnerabilities to manipulate database queries.

C) Constraining legitimate characters to exclude special characters and D) Limiting the length of the input field are both direct methods to reduce the risk of SQL injection. They focus on controlling user input, which is the vector through which SQL injection attacks are launched. By restricting special characters that could be used in SQL commands and limiting input lengths, an application can reduce the potential for malicious input to form a part of SQL queries executed by the backend database.