Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

During an security incident, an incident response team has successfully isolated an infected enterprise application server from the internal network. According to standard incident response lifecycle frameworks, which of the following actions represents the primary goal of the eradication phase?

  1. Eliminating the root cause of the incident by removing malware, revoking compromised credentials, and patching vulnerabilitiesAnswer
  2. B
    Restoring affected systems to normal operational status from clean backups and reconnecting network interfaces
  3. C
    Holding a post-incident review meeting with stakeholders to document lessons learned and update playbooks
  4. D
    Acquiring volatile memory captures and recording forensic timeline details to establish chain of custody

Answer

The primary goal of the eradication phase is eliminating the root cause of the incident by removing malware, revoking compromised credentials, and patching vulnerabilities.
The eradication phase in standard incident response frameworks (e.g., NIST SP 800-61) is dedicated to identifying and removing all components of the threat actor's presence. This includes deleting malware, closing exploited vulnerabilities, and revoking compromised access credentials before proceeding to recovery.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario state.
The server has been contained (isolated), so the team transitions to the eradication phase.
Containment limits damage, but the root cause of compromise remains on the host until removed.
2
Determine the specific objectives of the eradication phase in standard frameworks (such as NIST SP 800-61).
Eradication requires deleting malicious software, removing rogue user accounts, disabling compromised API keys, and mitigating underlying vulnerabilities.
Systems cannot be safely restored to production until all traces of adversary presence are eliminated.

Key Concept

Incident Response Lifecycle - Eradication Phase Objectives
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic