Eradication and recovery in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the primary goal of eradication in cybersecurity

What is the main purpose of the eradication phase in a cybersecurity incident response?

A To remove all traces of the attacker and malicious artifacts from the system

B To monitor the system for future attacks without making changes

C To restore normal business operations without addressing the root cause

D To identify the source of the attack and notify law enforcement

💡 Hint

Think about what must be done after detecting an intrusion to prevent it from happening again.

The eradication phase focuses on completely removing the attacker’s presence and any malicious software or backdoors to ensure the system is clean before recovery.

📋 Factual

intermediate

Key activities during the recovery phase

Which of the following activities is typically performed during the recovery phase of incident response?

A Scanning the network for vulnerabilities

B Rebuilding affected systems and restoring data from backups

C Conducting a root cause analysis to find the attack vector

D Deploying new firewall rules to block attackers

💡 Hint

Consider what is necessary to bring systems back to normal operation after an attack.

The recovery phase involves restoring systems and data to a trusted state, often using backups, so normal operations can resume safely.

🔍 Analysis

advanced

Analyzing the impact of skipping eradication

What is the most likely consequence if an organization skips the eradication phase and moves directly to recovery after detecting a cyberattack?

A The attacker may still have access, leading to repeated compromises

B Systems will be restored faster with no negative effects

C The organization will have a detailed report of the attack

D The recovery phase will automatically remove all threats

💡 Hint

Think about what happens if malicious elements remain in the system after recovery.

Without eradication, attackers or malware may remain, causing further damage or repeated breaches even after recovery.

❓ Comparison

advanced

Distinguishing eradication from recovery

Which statement best distinguishes the eradication phase from the recovery phase in incident response?

A Eradication notifies stakeholders; recovery isolates affected systems

B Eradication restores backups; recovery removes malware

C Eradication monitors for attacks; recovery analyzes attack methods

D Eradication removes threats; recovery restores systems to normal operation

💡 Hint

Focus on the main goal of each phase in the incident response process.

Eradication focuses on removing the attacker and malicious elements, while recovery focuses on bringing systems back to normal working condition.

❓ Reasoning

expert

Prioritizing actions during eradication and recovery

An organization has detected a ransomware attack affecting multiple servers. Which sequence of actions best represents the correct order during eradication and recovery?

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Consider the logical order to stop the attack, clean systems, restore data, and confirm safety.

First, isolate infected servers to prevent spread. Then remove ransomware (eradication). Next, restore data (recovery). Finally, verify integrity and monitor to ensure no reinfection.