Back to Security Incident Response and Recovery

Incident Eradication and Recovery

5 minutes 5 Questions

After incident containment, the eradication phase focuses on eliminating all components and artifacts related to the security incident. This may involve cleaning or replacing affected systems, applying patches, updating software, and removing unauthorized access accounts. Appropriate documentation …

Test mode:
Start practice test
CISSP - Incident Eradication and Recovery Example Questions

Test your knowledge of Incident Eradication and Recovery

Question 1

Following a data breach, an organization has identified malware running on their network. During the incident eradication phase, what should be done to ensure that the malware is fully removed?

Correct Answer: Perform a comprehensive malware analysis and remove all identified infections

Performing a comprehensive malware analysis and removing all identified infection ensures that the malware is fully removed. This helps in identifying the extent and impact of the infection and preventing future reoccurrence.

Question 2

A critical web server has been defaced by a hacker. How should the company proceed during the incident eradication phase?

Correct Answer: Restore from a trusted backup and perform a forensic analysis

The company should restore the compromised server from a trusted backup, ensuring it is malware-free, and then perform a forensic analysis to identify the vulnerability that allowed the hacker access and ensure it is remediated.

Question 3

During the recovery phase after a major security incident involving multiple systems, what is the most effective approach to prioritize system restoration?

Correct Answer: Restore systems based on their criticality to business operations

The most effective approach to prioritize system restoration after a major security incident is to restore systems based on their criticality to business operations. This approach ensures that the most important systems and services are brought back online first, minimizing the impact on the organization's core functions.

Reasons why this is the best approach:
1. It aligns with business continuity principles
2. It focuses resources on the most crucial systems first
3. It helps maintain essential business operations during recovery
4. It allows for a structured and prioritized recovery process

The other options are less effective:

Restoring all systems simultaneously is not practical or efficient, as it may overwhelm resources and delay the recovery of critical systems.

Restoring systems in the order they were compromised does not consider the importance of each system to business operations, potentially leaving critical systems offline for longer periods.

Restoring systems with the least complex configurations first does not prioritize based on business impact, which could result in critical systems remaining unavailable while less important ones are restored.

In conclusion, prioritizing system restoration based on criticality to business operations is the most effective approach for a CISM to recommend during the recovery phase after a major security incident.

More Incident Eradication and Recovery questions
36 questions (total)
Start 36 question test