At a manufacturer, the infected host is already isolated, the malware has been removed, and the production line is still down. What phase work remains?
Select an answer to reveal the explanation.
Short Explanation
The fire is out, and the room stays empty until you move the furniture back. Isolation and removal are done, the line is still down, and the remaining work is recovery from a known-good state. More detection, rewriting the plan, or a workshop does not restore production.
Full Explanation
Containment and eradication are already done: the host is isolated and the malware is gone. The line is still down, so the remaining work is recovery. Recovery work that restores the production line from a known-good state now that the malware is gone puts the line back from a trusted state. More detection and further alert tuning aimed at a host that is already isolated and cleaned of the malware repeats detection on a host the team has already cleaned. Drafting the incident-response plan the plant already uses for this kind of event is preparation, and that plan already exists. A threat-model workshop treated as the repair for the production line that is still down is a design exercise and does not return the line to service. Exam caveat: recovery sits inside containment, eradication, and recovery; it is not a fifth phase. NIST SP 800-61 Rev. 3 maps those phases onto CSF 2.0 Functions and does not make the four names the only model in Rev. 3. Operational check: restore from a known-good image or backup, confirm the expected processes are running, and only then return the line to production.