Certified Incident Handler (CIH) Practice Ecam

Which stage involves verifying that the incident cannot recur?

1. Recovery

2. Eradication

3. Post-Incident Review

4. Detection

The correct answer is: Eradication

The stage that involves verifying that the incident cannot recur is the eradication stage. During this phase, the primary focus is to eliminate the root cause of the incident, ensuring that all vulnerabilities have been addressed and any malicious artifacts removed. This thorough investigation and remediation are crucial to prevent the same incident from happening again in the future. In addition to removing threats, this step ensures that systems are secure, configurations are hardened, and that processes are in place to mitigate similar threats down the line. By thoroughly validating that the identified vulnerabilities have been properly resolved, organizations can attain a state where they are confident the incident cannot reoccur. Other stages mentioned, such as recovery, primarily focus on restoring systems and services to normal operations after an incident, while the post-incident review is concerned with analyzing the incident for lessons learned and improving future incident response processes. Detection relates to identifying incidents as they occur. While all these stages are essential components of an incident response plan, verification that an incident cannot recur specifically falls under eradication.