Certified Incident Handler (CIH) Practice Ecam

During which stage do incident responders typically rebuild a compromised system?

1. Preparation

2. Eradication

3. Recovery

4. Detection

The correct answer is: Recovery

In the incident response process, the recovery stage is critical as it focuses on restoring and validating system functionality after an incident. During this stage, incident responders typically rebuild compromised systems to ensure that any malicious changes, backdoors, or vulnerabilities introduced during the incident are completely eliminated. Rebuilding involves reinstalling operating systems, restoring data from clean backups, and applying necessary patches or updates to prevent future compromises. This process not only restores the system to a secure operational state but also validates that the recovery efforts have been successful and that the system is safe for use again. The other stages serve different purposes: preparation involves planning and readiness before incidents occur, eradication deals with removing threats and vulnerabilities identified during an incident, and detection focuses on identifying and understanding the incident when it first occurs. However, it is during recovery that the actual rebuilding and restoration of the compromised system takes place, making it the critical stage for this action.