Containment and Eradication Strategies Quiz

What you'll be asked

1. Which of the following is the primary goal of the 'Containment' phase in the Incident Response Lifecycle?
2. You have identified a workstation infected with ransomware that is attempting to communicate with a Command and Control (C2) server. What is the most effective immediate containment strategy?
3. During the Eradication phase, why is it critical to perform a vulnerability assessment after removing malicious artifacts?
4. When dealing with a high-profile, sophisticated threat, why might an organization choose 'Short-term Containment' over 'Long-term Containment' initially?
5. A threat actor has established persistence via a compromised service account. During eradication, which combination of actions is mandatory to ensure the account cannot be used again?

Answers and explanations come after you submit.