In the incident response lifecycle, which phase follows Containment?

• A. Identification
• B. Recovery
• C. Eradication
• D. Lessons Learned

Answer: (C)

The key idea here is the order of actions in incident response. After containment, the focus is on eradication: completely removing the threat from the environment. This means eliminating malware, closing backdoors, revoking compromised credentials, and patching or mitigating the vulnerabilities that allowed the breach. Eradication ensures there are no remaining footholds for the attacker, which is essential before bringing systems back online.

Only then does recovery begin, which reestablishes services and verifies system integrity, but with the threat already removed to prevent reoccurrence. Identification occurs earlier in the lifecycle, as the incident is detected and defined, while lessons learned come after recovery to review what happened and improve defenses.