During the eradication phase, what information should be analyzed to determine the cause and symptoms of an incident?

The preparation phase occurs before an incident and establishes policies and tools; the recovery phase occurs after eradication, so neither provides the cause-and-symptom data needed at this stage.

The identification phase produces evidence about how the incident was discovered, what indicators of compromise exist, and which systems are affected. The containment phase adds further forensic detail gathered while limiting the attack. Together these two phases provide the complete picture of cause and symptoms needed to perform thorough eradication without leaving residual threats.

A vulnerability scan performed during recovery is used to verify remediation completeness, not to determine the initial cause and symptoms of the incident.

Interviews with system owners can supplement analysis but alone are insufficient; the primary data source is the technical evidence collected during identification and containment.