An incident has been detected where an attacker accessed an administrative account using stolen credentials. After containing the incident, what is the correct next step in the incident response lifecycle?

Question

Accepted Answer

A. Eradication — removing the threat, changing compromised credentials, and closing the access vector. The incident response lifecycle sequence per the CySA+ exam objectives is: detection, analysis, containment, eradication, recovery, and lessons learned. After containment, eradication involves removing the attacker's access, changing compromised credentials, and closing the exploitation vector before systems are restored in recovery.

An incident has been detected where an attacker accessed an administrative account using stolen credentials. After containing the incident, what is the correct next step in the incident response lifecycle?

Related Questions

Discussion