Which of the following is the key point to consider in the recovery phase of incident handling? Which of the following is the key point to consider in the recovery phase of incident handling?

Isolating the source of the compromise is an activity belonging to the containment phase, which occurs before recovery.

Shutting down a system is a containment or eradication action taken earlier in the incident lifecycle, not a recovery activity.

Recovery involves restoring systems to normal operation, but doing so by restoring from a backup or image that still contains vulnerable code would immediately re-expose the environment to the same attack. Verifying that patches, secure configurations, and remediated code are in place before restoration is the defining concern of this phase per NIST SP 800-61.

Preparing the jump bag (incident response toolkit) is a preparation phase activity completed before any incident occurs.