Which of the following is the MOST important consideration in the eradication phase of incident response?

The correct answer is B. Forensics of the incident. The eradication phase requires understanding exactly what occurred-what was compromised, how the attacker gained and maintained access, and what artifacts were left behind-so that every element of the threat can be fully removed without leaving backdoors or residual malware…

Submitted by lars.no· Apr 18, 2026Incident Management

Question

Options

ATesting of backup strategies
BForensics of the incident
CCategorization of systems
DRevisions to incident tabletop exercises

How the community answered

(51 responses)

B
94% (48)
C
2% (1)
D
4% (2)

Explanation

The eradication phase requires understanding exactly what occurred-what was compromised, how the attacker gained and maintained access, and what artifacts were left behind-so that every element of the threat can be fully removed without leaving backdoors or residual malware. Without forensic investigation, eradication may be incomplete and the threat could persist or recur. Testing backup strategies (A) is part of the recovery phase. Categorization of systems (C) occurs during the identification and scoping phases. Revisions to tabletop exercises (D) are post-incident lessons-learned activities that occur after full incident closure, not during eradication.

Topics

#Incident Response Phases#Eradication#Forensics#Root Cause Analysis

Community Discussion

No community discussion yet for this question.

Full CISM Practice