Which one of the following is a fundamental objective in handling an incident?

The fundamental objective of incident handling is to restore control of affected systems to minimize damage, contain the incident, and return to normal operations as quickly as possible. This aligns with the core phases of incident response (containment, eradication, and recovery) defined in frameworks like NIST SP 800-61, which emphasize operational restoration as the primary goal.

Confiscating suspect computers is a law enforcement action that may occur during forensic investigation but is not a fundamental incident handling objective for most organizations.

Prosecuting the attacker is a potential legal outcome but is not a primary incident response objective; many incidents never lead to prosecution, and it is outside the direct scope of incident handling teams.

Performing full backups is a preventive and recovery-support activity done before or after an incident, not a fundamental objective during active incident handling.