Malware is spreading laterally between virtual machines in a company's IaaS virtual network. An analyst wants to immediately reimage the first infected virtual machine to remove the malware. According to the incident response lifecycle, what should happen before eradication?

Incident response frameworks order the work as preparation, detection and analysis, containment, eradication and recovery, then post-incident activity. Containment limits damage and spread; in IaaS this usually means applying restrictive network security group rules or moving instances to an isolated segment, revoking compromised credentials and taking snapshots of disks and, where possible, memory before anything is destroyed. Only once the spread is stopped and evidence is preserved does eradication, such as reimaging or rebuilding from a trusted image, take place. Reimaging the first instance immediately destroys forensic evidence about the initial infection and does nothing about the other machines that are already compromised, so the malware continues to move. Restoring all instances from backup before the entry point is known risks reintroducing the infection, because the backup or the vulnerability may still be present; restoration belongs to recovery. A lessons-learned review is valuable but happens after the incident is resolved, not while the spread is active. Exam caveat: containment strategy must weigh business impact, evidence needs and attacker awareness. Operational check: verify that isolation rules block east-west traffic from affected instances, that snapshots are taken and hashed, and that no new infections appear before eradication starts.