GCIH · Question #461
What is the primary goal of the Eradication phase of handling an incident?
The correct answer is A. Removing all artifacts left by the attacker. The Eradication phase of incident response is specifically focused on removing all malware, backdoors, and attacker artifacts from affected systems.
Question
What is the primary goal of the Eradication phase of handling an incident?
Options
- ARemoving all artifacts left by the attacker
- BGetting the compromised machine back into production
- CDetermining if an incident has occurred
- DCreating disk images for forensics purposes
How the community answered
(28 responses)- A89% (25)
- C4% (1)
- D7% (2)
Why each option
The Eradication phase of incident response is specifically focused on removing all malware, backdoors, and attacker artifacts from affected systems.
In the NIST SP 800-61 incident response lifecycle, the Eradication phase follows Containment and is defined as the process of eliminating the root cause of the incident - removing malware, closing exploited vulnerabilities, deleting attacker-created accounts, and purging any other artifacts left by the adversary. This is distinct from recovery, which restores normal operations after eradication is confirmed complete.
Returning a compromised machine to production is the goal of the Recovery phase, which occurs after Eradication has been verified.
Determining whether an incident has occurred belongs to the Identification (Detection and Analysis) phase, which happens before Containment and Eradication.
Creating disk images for forensic analysis is a Containment phase activity performed to preserve evidence before remediation begins.
Concept tested: NIST incident response Eradication phase objective
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.