PCI SSCPCI DSSIncident ResponseEASYFree question
What is eradication in the incident response process?
- A.Restoring systems from backup, which returns servers to production and confirms that business operations can resume
- B.Removing the root cause of the incident, such as eliminating malware, closing exploited vulnerabilities, and removing unauthorized access mechanisms
- C.Capturing disk images of affected hosts, which preserves evidence and supports later legal proceedings
- D.Isolating infected hosts from the network, which stops lateral movement and limits the scope of exposure
Why B is correct
Eradication removes the incident's root cause including malware removal, vulnerability patching, and elimination of unauthorized access methods.
Know someone studying for PCI DSS? Send them this one.