Question

A security analyst confirms that a workstation is infected with malware that has established persistence through a malicious scheduled task and a modified registry key. The affected system has already been isolated from the network. Following the NIST incident response process, which phase's activities should the analyst perform NEXT?

Accepted Answer

Eradication — remove the malicious scheduled task, revert the registry changes, and delete malware artifacts

Answer

Containment — disconnect the system from the network and disable its switch port

Answer

Recovery — restore the system to production and monitor for reinfection

Answer

Lessons learned — document the timeline and update the incident response plan