Exam 300-215 topic 1 question 12 discussion

The goal is to eliminate the entry point(s) that the threat actor used to obtain access to the network [1], so adding rules to the IPS and centralized user management seem reasonable. TCP 135 is the MSRPC endpoint mapper. You can bind that port on a remote computer, anonymously, and either enumerate all the services (endpoints) available on that computer, or you can request what port a specific service is running on [2]. References: [1] https://cipher.com/blog/the-core-phases-of-incident-response-remediation/ [2] https://docs.microsoft.com/en-US/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements