After containing a library ransomware outbreak, responders delete attacker accounts and persistence, then restore catalog servers from clean backups. Which pair correctly labels those two steps?
Select an answer to reveal the explanation.
Short Explanation
Eradication is scrubbing the infection out; recovery is putting the library catalog back on the shelf from a clean backup. Removing persistence kills the cause, and restoring services gets patrons searching books again. Mixing those labels usually means someone restored too early or cleaned too late.
Full Explanation
Eradication focuses on removing the root cause—malware, unauthorized accounts, and persistence mechanisms—from affected systems. Recovery restores business services, typically from verified clean backups or rebuilt images, and validates normal operation. Detection and analysis precede containment; preparation and lessons learned bookend the lifecycle. Legal hold is a forensic/preservation concern, not a substitute for eradication or recovery.