Which stage of incident handling involves removing the root cause and restoring systems to normal operation?

• A. Containment
• B. Eradication
• C. Recovery
• D. Post-incident lessons

Answer: (B)

The stage being tested is about removing the underlying cause of the incident and cleaning up so systems can return to normal. In this phase you eliminate the root problem and any malicious artifacts, not just stop the current spread. Think of it as cleansing the environment: removing malware, closing the vulnerability that allowed the breach, updating or patching software, resetting compromised credentials, and verifying that the systems are clean before they’re put back into production.

Containment, by contrast, is about limiting damage and preventing further spread, which happens before you fully eradicate the threat. Recovery focuses on bringing systems back online and restoring services after the threat has been removed. Post-incident lessons is about learning from what happened to strengthen defenses for next time.