Which stage of incident handling would you perform immediately after containment to restore normal operations?

• A. Identification
• B. Containment
• C. Recovery
• D. Eradication

Answer: (C)

After containment, the focus shifts to Recovery, the phase that aims to bring systems and services back to normal operation. This involves restoring data from clean backups, reinstating affected services, reapplying trusted configurations and patches, and closely monitoring the environment to ensure stability and that no remnants of the incident remain.

Identification and Containment happen earlier in the process, and Eradication is about removing the threat itself. While eradication may occur alongside recovery, the explicit objective of this step is to restore operations and verify integrity before resuming normal business functions.