Pretty sure it should be C. To see if risk mitigation is really working, you have to look at whether the controls are actually cost-effective and reducing risk, not just if systems are documented (D is more about asset inventory). Seen similar questions in practice material. Anyone see an argument for B here?

Had something like this in a mock recently. The main goal of hardening is to securely configure devices to minimize vulnerabilities, so limiting the attack surface. Option A lines up with that. The others are more about detection or analysis after the fact, not prevention.

Option D might fit if the question was asking about incident response, but since it's about hardening, do they mean "best purpose" or just "one of the purposes"? That would change things here.

D imo makes sense if the focus was on fixing payments quickly, but since it's asking what to do first, A fits better because you need to figure out what happened before jumping to manual fixes. Is there a specific company policy that prioritizes incident escalation over initial investigation?

Shouldn't we check with the SaaS tool team first to figure out what went wrong before escalating? Jumping to B seems like an easy trap here, since you don’t know the scope or if it’s a breach yet.