After ransomware hits a county tax system, the IR lead must apply the lifecycle in the right order. Which sequence is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of IR like a fire drill you practice before the alarm, then find the fire, size it up, stop the spread, put it out, reopen the building, and write down what to fix. Preparation comes first so nobody invents a plan under ransomware pressure. Skipping containment before eradication is like mopping flames while they still jump to the next floor.
Full Explanation
The CompTIA-aligned incident response lifecycle is intentionally ordered so each phase enables the next: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. For a county tax system hit by ransomware, preparation is not optional background work—it is the phase that pre-stages contact trees, forensic tooling, decision authority, and playbooks before the tax database is encrypted. Detection and analysis then establish that an incident is occurring and characterize scope, impact, and attacker activity so responders do not guess under pressure. Containment limits further encryption and lateral movement across assessor and treasurer systems; only after spread is controlled does eradication remove persistence, malicious accounts, and compromised hosts. Recovery restores tax services from verified clean backups and validates integrity before citizen-facing portals reopen. Lessons learned converts the event into durable control and process improvements.
Sequences that begin with detection or containment while postponing preparation invert readiness: the municipality invents roles and tooling while systems are already down. Orders that jump to eradication or recovery before analysis and containment risk incomplete cleanup or premature restoration that reintroduces the threat. Placing preparation after active response phases treats planning as an afterthought rather than a standing capability. On the exam, memorize the full order and resist distractors that shuffle containment, eradication, and recovery. Operationally, verify the county’s IR plan lists these phases in sequence, that playbooks map actions to each phase, and that tabletop exercises rehearse the handoffs—especially the rule that services do not return until eradication criteria are met and backups are confirmed clean.