Question

A SOC team has removed malware and closed the exploited vulnerability on several compromised web servers. Management now wants the servers returned to production. Before restoring them, the incident response lead insists on monitoring the systems in a controlled manner and confirming they behave normally. Which incident response phase does this activity represent, and what is its primary goal?

Accepted Answer

Recovery — safely restore affected systems to normal operations while validating they are no longer compromised

Answer

Eradication — remove all traces of the threat from the environment before any restoration

Answer

Containment — limit the spread of the incident by isolating affected hosts

Answer

Lessons learned — document the incident and improve future response processes