A ransomware outbreak has been contained by isolating the affected servers. The team must now decide the order of the next activities. Which sequence is CORRECT?
Select an answer to reveal the explanation.
Short Explanation
You clean the wound before you stitch it up. Eradication removes the malware and every way it planned to come back; recovery then brings systems online and watches them. Restore first and you can end up restoring right on top of the attacker's backdoor - that's the trap.
Full Explanation
After containment, the incident response process moves to eradication and recovery. Eradication removes the threat from the environment: deleting malware, removing persistence such as scheduled tasks or rogue accounts, closing the initial access vector, and resetting compromised credentials. Recovery then restores affected systems to normal operation, typically from known-good backups or rebuilt images, validates their integrity, and reconnects them with heightened monitoring to detect any recurrence. Doing these in order prevents reinfection from a foothold the attacker left behind. Restoring from backup before eradication risks reintroducing the attacker, because backups may contain persistence mechanisms or the environment may still expose the original entry point and compromised credentials. Writing the lessons-learned report belongs in the post-incident phase, after the threat is removed and operations are restored; delaying eradication for documentation prolongs the incident. Reconnecting servers before cleaning them reverses containment and allows the malware to spread again before scans run. Exam caveat: in the SY0-801 objectives, negotiation also appears between containment and eradication, which applies when organizations deal with extortion demands. Operational check: before reconnecting restored systems, confirm known indicators are absent, credentials used by the attacker are reset, and enhanced monitoring alerts are active.