In which of the following steps of the incident handling processes does the Incident Handler make sure that all business processes and functions are back to normal and then also wants to monitor the…

Eradication focuses solely on removing the root cause of the incident (malware, backdoors, vulnerabilities) but does not involve restoring business processes to normal or post-restoration monitoring.

Lessons Learned is a post-incident documentation and review phase conducted after full recovery, focused on improving future response, not on restoring services.

Recovery is the phase where the incident handler restores all affected systems and business processes to their normal operational state. After restoration, the handler actively monitors the environment to confirm the threat is fully resolved and that no reinfection or recompromise occurs. This distinguishes Recovery from Eradication, which only removes the threat without restoring services or adding monitoring.

Containment limits the spread and impact of an incident in progress but does not restore business functions or involve monitoring for recompromise.