Which phase focuses on removing the root cause of the incident and closing all attack vectors to prevent recurrence?

Which phase focuses on removing the root cause of the incident and closing all attack vectors to prevent recurrence?

• A. Eradication Phase
• B. Incident triage
• C. Machine Learning
• D. Incident Handling and Response

Answer: (A)

Removing the root cause and closing attack vectors to prevent recurrence describes the eradication phase of incident response. In this phase you identify exactly how the breach occurred, remove all traces of the attacker and any malware, patch or remediate the exploited vulnerability, rotate credentials, and harden systems so the same entry point can’t be reused. You also verify that no backdoors remain and monitor for any signs of re-infection before moving to recovery. This isn’t about initial assessment or prioritization (that’s triage), and it isn’t the broad umbrella of incident handling and response which covers the full cycle from detection through recovery. It’s also not about applying machine learning; ML is a tool that can aid detection and analysis but isn’t a dedicated phase focused on eliminating the root cause.

Removing the root cause and closing attack vectors to prevent recurrence describes the eradication phase of incident response. In this phase you identify exactly how the breach occurred, remove all traces of the attacker and any malware, patch or remediate the exploited vulnerability, rotate credentials, and harden systems so the same entry point can’t be reused. You also verify that no backdoors remain and monitor for any signs of re-infection before moving to recovery.

This isn’t about initial assessment or prioritization (that’s triage), and it isn’t the broad umbrella of incident handling and response which covers the full cycle from detection through recovery. It’s also not about applying machine learning; ML is a tool that can aid detection and analysis but isn’t a dedicated phase focused on eliminating the root cause.