After an intrusion, the operations team wants to restore a key application to service immediately, although the attacker's persistence mechanisms and entry point have not yet been removed. What should the security manager advise?

The incident response sequence places eradication before recovery for good reason. Eradication removes the attacker's footholds, such as malware, backdoors, unauthorized accounts and scheduled tasks, and closes the vulnerability or credential weakness that allowed entry. Recovery then returns systems to normal operation in a state where the attacker cannot simply resume. Restoring first and planning to remove persistence later leaves the attacker with active access to a production system and its data in the meantime, often leading to reinfection and a second, more damaging incident. Assuming backups are always free of persistence is incorrect; backups taken after the compromise may contain the same backdoors, and restoring them while the entry point remains open allows the attacker straight back in. Relying on antivirus to block further access ignores the fact that existing controls already failed to prevent the intrusion and that many persistence techniques use legitimate tools and credentials. Exam caveat: business pressure for rapid restoration is legitimate, and long-term containment measures can sometimes provide interim service, but the decision to accept that risk belongs to the business owner. Operational check: confirm eradication actions are completed and verified before the recovery plan is approved.