What Is the Most Critical Eradication Step to Prevent Re-infection After a Backdoor?
After containing a ransomware incident, the incident response team identifies that the attacker gained initial access through a phishing email that installed a backdoor. Which of the following eradication steps is MOST critical to prevent re-infection?
Quick Answer
Removing the backdoor executable and its persistence mechanisms is the most critical eradication step because it directly severs the attacker's foothold, the specific artifact that let them regain access after containment. Persistence mechanisms such as scheduled tasks or registry Run keys are how malware survives a reboot or a cleanup pass that only deletes the obvious file, so eradication has to address both the executable and whatever mechanism relaunches it; missing either one leaves a path back in. Reimaging the system would also remove the backdoor, but it's a heavier, more disruptive option that isn't necessary on every affected system when a targeted removal accomplishes the same goal with less downtime, so reimaging isn't wrong so much as overkill for this step. Password resets and user training matter too, but they belong to different phases of incident response: resets support recovery by making sure recovered accounts aren't still using compromised credentials, and training is a longer-term preventive measure aimed at stopping the initial phishing vector from working again. Neither one touches the backdoor itself. When a question asks what's MOST critical during eradication specifically, look for the option that removes the actual malicious artifact and its ability to reappear, not the options addressing recovery or future prevention.
⚠ Common exam trap
Many exam-takers confuse eradication with recovery or prevention, choosing reimaging (Option B) or training (Option D) instead of recognizing that removing the attacker's specific foothold is the immediate technical priority to stop re-infection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Removing the backdoor executable and associated persistence mechanisms
In the eradication phase, the immediate priority is to remove the attacker's direct access and persistence mechanisms. While reimaging (Option B) also removes the backdoor, it is a more time-consuming and disruptive approach that may not be necessary for all systems. Removing the backdoor executable and persistence mechanisms (e.g., scheduled tasks, registry Run keys) directly eliminates the attacker's foothold, preventing re-infection from the same vector without the overhead of full reimaging. Password resets (Option A) and training (Option D) are important but address different phases (recovery and prevention) and do not directly remove the existing backdoor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Resetting all user passwords
Why it's wrong here
Resetting passwords is important but does not remove the backdoor from the system.
- ✗
Reimaging all affected systems from a known-good backup
Why it's wrong here
Reimaging is effective but the question asks for the MOST critical step; if the backdoor is still present, reimaging might be necessary. However, the scenario implies the backdoor is already identified and removal can be attempted.
- ✓
Removing the backdoor executable and associated persistence mechanisms
Why this is correct
Directly removing the backdoor prevents it from being used again. Combined with patching, this is critical.
- ✗
Conducting security awareness training for all employees
Why it's wrong here
Training reduces future risk but does not address the current infection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?
medium- A.Reimaging the system from a verified clean image
- B.Resetting compromised user credentials
- ✓ C.Removing malicious files and cleaning registry persistence
- D.Patching the exploited vulnerability
Why C: During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.