Certified Incident Handler (CIH) Practice Ecam

What is the primary goal of the eradication step in incident response?

1. To restore services

2. To identify the vulnerabilities

3. To eliminate the root cause of the incident

4. To gather evidence

The correct answer is: To eliminate the root cause of the incident

The primary goal of the eradication step in incident response is to eliminate the root cause of the incident. This step involves identifying and removing any threats from the environment to ensure that the same issue does not reoccur in the future. By focusing on the root cause, incident responders aim to prevent the incident from happening again, which is crucial for achieving long-term security and stability within the affected systems or networks. While restoring services is important, it is typically part of the recovery phase that follows eradication. Identifying vulnerabilities is essential for understanding how an incident occurred, but it is not the primary focus during eradication. Gathering evidence is vital for understanding the incident and for any potential legal or compliance requirements, but again, this task is distinct from the objective of eradicating the threat itself. Therefore, the emphasis of eradication is firmly grounded in addressing and removing the underlying issues that led to the incident.