Which of the following are activities that should be completed during the containment and eradication phases of the incident response process? (Choose two.)

The correct answer is C. Identifying the threat D. Removing the malicious threat. During containment, you first pinpoint exactly what malware or attack vector is in play and how far it has spread - i.e. identifying the threat. Then, in the eradication phase, you eliminate the root cause by removing the malicious threat (malware, backdoors, unauthorized…

Submitted by zhang_li· Mar 6, 2026Security Operations

Question

Options

ANotifying stakeholders
BRestoring the system
CIdentifying the threat
DRemoving the malicious threat
EDeveloping a recovery plan
FAnalyzing the incident

How the community answered

(35 responses)

A
3% (1)
C
94% (33)
E
3% (1)

Explanation

During containment, you first pinpoint exactly what malware or attack vector is in play and how far it has spread - i.e. identifying the threat. Then, in the eradication phase, you eliminate the root cause by removing the malicious threat (malware, backdoors, unauthorized accounts, etc.) before moving on to system recovery.

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice