A cybersecurity analyst has recovered a recently compromised server to its previous state. Which of the following should the analyst perform next?

The correct answer is D. Forensic analysis. After recovering a compromised server to its previous state, the analyst should perform forensic analysis to determine the root cause, impact, and scope of the incident, as well as to identify any indicators of compromise, evidence, or artifacts that can be used for further…

Submitted by diego_uy· Mar 6, 2026Incident Response and Management

Question

Options

AEradication
BIsolation
CReporting
DForensic analysis

How the community answered

(22 responses)

B
5% (1)
C
9% (2)
D
86% (19)

Explanation

After recovering a compromised server to its previous state, the analyst should perform forensic analysis to determine the root cause, impact, and scope of the incident, as well as to identify any indicators of compromise, evidence, or artifacts that can be used for further investigation or

Topics

#incident response#recovery#forensic analysis#IR lifecycle

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice