You work as an Incident handling manager for Orangesect Inc. You detect a virus attack incident in the network of your company. You develop a signature based on the characteristics of the detected vir

Containment focuses on isolating and limiting the spread of an incident, not on applying signatures to actively remove malicious code.

Recovery involves restoring systems to normal operation after the threat has already been removed during eradication, not the removal itself.

Identification is the phase where the incident is detected and its scope is assessed, which already occurred before the virus signature was developed.

Eradication is the phase in which the root cause of an incident is fully eliminated from all affected systems. A signature developed from detected virus characteristics is applied during this phase to scan for and remove every instance of the malware, ensuring the threat is completely purged from the network before recovery begins.