Exam CS0-002 topic 1 question 328 discussion

The next step after detecting an ongoing attack is to CONTAIN it. D is the optimal course of action in that regard. Solution A should be done AFTER containing it, namely during the eradication phase. B is incorrect because it doesn't provide the requisite immediacy. Also, senior management should have already provided basic guidance for situations like this in the form of training and administrative controls (policies and SOPs). C only provides partial containment at best by hindering privilege escalation, which most likely isn't the only possible attack surface. It's not worth potentially disrupting those accounts' business activities just for a half-measure. D is the only viable option. It's certainly no fix-all, but it'll at least obstruct the attacker immediately without unnecessarily disrupting business operations.

I think D makes sense, by following the incident response process this would be a containment action after detecting the attack. Further steps like applying patches would be the eradication.