ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response

Which phase of the incident response process involves restoring systems to normal operations and confirming they are functioning correctly?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Recovery

Recovery is the phase after eradication where systems are restored and tested.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Recovery
Why this is correct
Recovery restores affected systems to normal operations and verifies they function correctly, directly satisfying the stem's requirement. Unlike eradication, which removes the threat, or lessons learned, which reviews the incident afterwards, recovery focuses on validated restoration. It confirms services are operational before returning to normal business activity.
✗
Detection
Why it's wrong here
Detection identifies and analyses potential security events; it does not restore systems or verify they function correctly. Detection is the correct phase when monitoring alerts must be triaged to confirm whether an incident has actually occurred, before any recovery work begins.
✗
Containment
Why it's wrong here
Containment limits the incident's spread and impact, for example by isolating hosts or segmenting networks; it does not restore normal operations. Containment is the correct phase when the priority is stopping lateral movement while evidence is preserved for investigation.
✗
Eradication
Why it's wrong here
Eradication removes the root cause, such as malware or compromised accounts, from affected systems; restoration and functional verification occur afterwards. Eradication is correct when the goal is eliminating the threat's underlying cause rather than returning systems to service.

Go deeper