Certified Information Security Manager (CISM) — Question 423

The PRIMARY goal of the eradication phase in an incident response process is to:

Answer options

• A. provide effective triage and containment of the incident.
• B. remove the threat and restore affected systems.
• C. maintain a strict chain of custody.
• D. obtain forensic evidence from the affected system.

Correct answer: B

Explanation

The correct answer, B, focuses on the crucial task of eliminating the threat and restoring systems to normal operation, which is essential for resolving the incident. Options A, C, and D are important aspects of incident response but pertain to different phases such as containment, evidence handling, and forensic analysis rather than eradication.