Eradication and recovery in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main goal of the eradication phase in cybersecurity incident response?

The main goal of eradication is to completely remove the cause of the security incident, such as malware or unauthorized access, to prevent it from happening again.

beginner

What does the recovery phase focus on after a cybersecurity incident?

The recovery phase focuses on restoring and validating system functionality to normal operations while ensuring that vulnerabilities are fixed and no threats remain.

intermediate

Why is it important to monitor systems after recovery?

Monitoring after recovery helps detect any signs of the incident reoccurring or new threats, ensuring the environment remains secure.

intermediate

Name two common actions taken during eradication.

Common actions include removing malware, closing exploited vulnerabilities, and deleting unauthorized user accounts.

beginner

How does recovery differ from eradication in incident response?

Eradication removes the threat, while recovery restores systems to normal operation and ensures they are safe to use.

What is the first step in the eradication phase?

A Restore system backups

B Identify and remove the root cause of the incident

C Notify stakeholders

D Monitor network traffic

Eradication begins by identifying and removing the root cause, such as malware or vulnerabilities.

During recovery, what is a key activity?

A Performing vulnerability scans

B Removing malware

C Conducting initial incident detection

D Restoring systems to normal operation

Recovery focuses on restoring systems to normal operation after threats are removed.

Why is it important to validate systems during recovery?

A To ensure the incident is fully resolved and systems are secure

B To increase network speed

C To create new user accounts

D To backup data

Validation confirms that threats are removed and systems are safe to use.

Which of the following is NOT part of eradication?

A Deleting unauthorized accounts

B Removing malware

C Restoring system backups

D Closing vulnerabilities

Restoring backups is part of recovery, not eradication.

What should be done after recovery to prevent future incidents?

A Monitor systems and update security measures

B Disconnect from the internet permanently

C Delete all logs

D Ignore the incident

Monitoring and updating security helps prevent recurrence of incidents.

Explain the difference between eradication and recovery in incident response.

Think about what happens first and what happens after removing the threat.

List key actions taken during the eradication phase.

Focus on how the threat is eliminated.