At a retailer, the team removes the malware, resets the passwords it used, and restores each register from a known-good image. Which incident-handling phase covers that work?
Select an answer to reveal the explanation.
Short Explanation
Putting out the fire, changing the burned lock, and reopening the shop is the cleanup itself. You are in containment, eradication, and recovery. The trap is calling that repair preparation, detection only, or a lessons memo with no cleanup.
Full Explanation
The exam phase for removing the foothold and returning systems to service is containment, eradication, and recovery. Malware removal, password resets, and the register restore are that work. Planning, confirmation alone, and lessons are the other phases. "Containment, eradication, and recovery: malware removal, password resets, and the register restore". Malware removal, password resets, and image restoration are the cleanup and return to service in that phase. "Preparation: writing the retailer incident plan and the full contact list before this incident existed". Preparation is the plan and contact work done before an incident exists. This retailer work happens during the incident, on the infected registers. "Detection and analysis only, ending once the alert is confirmed and before any cleanup work". Detection and analysis confirms what happened. The stem goes past confirmation into removal and restoration, so the work is not limited to finding the alert. "Post-incident analysis only, limited to lessons after the registers are already back in service". Post-incident analysis is the lessons after the response. Lessons matter, and they are not a substitute for the removal and restore described here. Exam caveat: NIST SP 800-61 Rev. 3 maps these phase names onto CSF 2.0 Functions. The exam still wants the four names, and Rev. 3 does not make that list its only model. Operational check: the ticket should show malware removal, password resets, and image restoration.