Certified Incident Handler (CIH) Practice Ecam

Which of the following actions should be performed by incident responders during the recovery stage of the incident response?

1. Rebuild the system by installing a new OS

2. Change user passwords immediately

3. Analyze the data loss

4. Document the recovery phase

The correct answer is: Rebuild the system by installing a new OS

During the recovery stage of the incident response, rebuilding the system by installing a new operating system is a critical action. This step ensures that any remnants of malware or vulnerabilities from the previous installation are completely eliminated, providing a clean and secure environment to restore services and data. It's a fundamental practice to ensure the integrity and security of the system before bringing it back online. Rebuilding the system allows for a fresh start, allowing the organization to implement any necessary updates or security measures that may not have been present before the incident. By ensuring that the system is free of any backdoors or malicious software, responders can mitigate the risk of a recurrence of the incident. While other actions like changing user passwords, analyzing data loss, and documenting recovery phases are important components of an overall incident response strategy, they typically occur either prior to or concurrently with system recovery rather than being the primary focus of the recovery phase itself. The main goal during recovery is to restore systems to a secure operational state, making the action of installing a new OS particularly significant.