Which step in incident response involves restoring services to normal operation?

Which step in incident response involves restoring services to normal operation?

• A. Detect
• B. Eradicate
• C. Recover
• D. Contain

Answer: (C)

Restoring services to normal operation is the Recover phase. This stage focuses on bringing affected systems and business processes back online after the threat has been contained and eradicated. It includes activities like restoring data from backups, reconfiguring or reinstalling systems, validating that applications and services are functioning correctly, and monitoring to ensure no signs of residual issues or renewed compromise appear. The goal is to resume normal operations quickly and safely while ensuring systems are stable and protected. Detect identifies the incident, Contain limits the spread, and Eradicate removes the threat from the environment; Recovery is what gets the organization back to normal operations.

Restoring services to normal operation is the Recover phase. This stage focuses on bringing affected systems and business processes back online after the threat has been contained and eradicated. It includes activities like restoring data from backups, reconfiguring or reinstalling systems, validating that applications and services are functioning correctly, and monitoring to ensure no signs of residual issues or renewed compromise appear. The goal is to resume normal operations quickly and safely while ensuring systems are stable and protected. Detect identifies the incident, Contain limits the spread, and Eradicate removes the threat from the environment; Recovery is what gets the organization back to normal operations.