During post-incident recovery, the IR team is determining when to bring a compromised e-commerce system back online. Which condition must be satisfied before production restoration?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because returning to production requires: clean rebuild (not patching a potentially backdoored system), remediated vulnerabilities (closed attack paths), improved monitoring (earlier detection next time), and documented lessons learned. A is wrong because PR activities are a communications function separate from technical recovery readiness.
Full explanation below image
Full Explanation
B is correct because returning to production requires: clean rebuild (not patching a potentially backdoored system), remediated vulnerabilities (closed attack paths), improved monitoring (earlier detection next time), and documented lessons learned. A is wrong because PR activities are a communications function separate from technical recovery readiness. C is wrong because time elapsed is not a security criterion; a system could still be compromised after 72 hours or could be safe to restore in 12 hours. D is wrong because blocking a single IP is trivially bypassed and does not indicate the system itself is clean.