Question 941 · 1243 in bank
During which of the following phases should an incident response team document actions required to remove the threat that caused the incident?
Show answer
Answer: A
Explanation
A. Eradication. During the Eradication phase of the incident response process, the focus is on removing the threat, eliminating any traces of the attacker, and restoring affected systems to their normal state. This phase involves taking specific actions to remediate the cause of the incident, such as applying patches, removing malware, closing vulnerabilities, or blocking access points used by the attacker. Documentation of the actions taken during the Eradication phase is crucial for several reasons. It helps ensure that the steps taken are properly recorded for future reference and can be used to update incident response procedures.
Source: Adapted from community discussion — mad68