A systems administrator has isolated an infected system from the network and terminated the malicious process from executing. Which of the following should the administrator do NEXT according to the…

After containing an infected system and eradicating the malicious process, the incident response process moves to the Recovery phase, where restoring lost or corrupted data from a clean backup is essential to bring the system back to a secure and operational state.

Wiping the system is generally part of the Eradication phase to remove all traces of the compromise, which occurs before the Recovery phase where data is restored.

Documenting lessons learned is a post-incident activity that occurs after the recovery and verification of the system's operational status, not immediately after containment and eradication.

Determining the scope of impact is part of the Identification phase, which typically happens much earlier in the incident response process, before containment and eradication.