During the eradication phase of incident response, which of the following actions is MOST critical to ensure the threat is completely removed from a compromised system?
Attackers often establish persistence; failing to remove it can lead to recompromise.
Why this answer
During the eradication phase, the primary goal is to ensure that no remnants of the attacker's presence remain on the system. Option C directly addresses this by removing malicious files and cleaning registry persistence, which eliminates backdoors, scheduled tasks, and other persistence mechanisms that could allow the threat to survive a reboot or evade detection. Without this step, even after patching or credential resets, the attacker could regain access through hidden persistence points.
Exam trap
A common mistake in the SSCP exam is confusing the eradication phase with the recovery phase. Candidates may select patching or reimaging because those actions seem thorough, but the key during eradication is removing all artifacts of the compromise, including persistence mechanisms, before recovering the system to production.
How to eliminate wrong answers
Option A is wrong because reimaging from a clean image is a valid recovery step, but it is not the most critical action during eradication; it is typically performed after eradication is complete to restore the system to a known good state, and it does not involve analyzing or removing the threat's artifacts. Option B is wrong because resetting compromised user credentials is a containment and recovery action that prevents further unauthorized access, but it does not remove the threat itself—malicious files and persistence mechanisms remain active. Option D is wrong because patching the exploited vulnerability is a preventive measure that closes the initial attack vector, but it does not remove existing malware or persistence; the threat may still be present and active on the system.