mediumMultiple ChoiceObjective-mapped
CISM Practice Question: During the eradication phase of an incident…
During the eradication phase of an incident response, which action is MOST critical to ensure the threat is fully removed?
⚠ Common exam trap
It's easy for candidates to choose to delete malware files or update antivirus signatures because they focus on the immediate threat removal, but fail to recognize that these actions cannot guarantee complete eradication of deeply embedded or persistent malware, which is why reimaging is the definitive step in the eradication phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reimage all affected systems from known-good backups.
Reimaging all affected systems from known-good backups is the most critical action during the eradication phase because it ensures complete removal of the threat, including any rootkits, persistence mechanisms, or hidden malware that may survive simple file deletion or signature-based scans. This approach eliminates the risk of residual compromise, as the system is restored to a trusted state from a verified backup, which is essential for environments where the integrity of the operating system and applications cannot be guaranteed after an incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the malware files from the system.
Why it's wrong here
May miss hidden components.
- ✗
Reset passwords for all user accounts.
Why it's wrong here
Important but not eradication of the threat itself.
- ✗
Update antivirus signatures.
Why it's wrong here
Preventive, not eradication.
- ✓
Reimage all affected systems from known-good backups.
Why this is correct
Only way to guarantee removal of persistent threats.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.