Certified Incident Handler (CIH) Practice Ecam

Which of the following steps should an incident responder consider when recovering the systems affected by an incident?

1. Determine the course of action

2. Perform a post-mortem analysis

3. Continue monitoring indefinitely

4. Disable all network access

The correct answer is: Determine the course of action

Determining the course of action is a critical step in the recovery process after an incident. This involves assessing the current situation to identify the most effective methods for restoring affected systems to normal operation. It requires an understanding of the incident's impact, the resources available, and the specific needs of the organization. When an incident occurs, an incident responder must first evaluate the severity of the incident, the extent of the damage, and what recovery measures are suitable. This can involve prioritizing which systems to restore first based on their importance to business operations and the potential risks of further damage if recovery is delayed. The other options, while important in the broader context of incident response, do not directly address the immediate next steps in recovering systems affected by an incident. For example, performing a post-mortem analysis is important for learning from the incident but typically occurs after recovery is achieved. Continuously monitoring indefinitely may not be practical or necessary once recovery actions are taken. Disabling all network access could unnecessarily hinder recovery efforts and prevent the restoration of normal operations, thereby prolonging downtime without offering clear benefits.