CySA+ Containment Eradication Recovery Quiz

1. During recovery, what is the benefit of a staged restoration approach?

It reduces recovery time

It allows monitoring for signs of re-infection

It eliminates the need for backups

It simplifies documentation

2. After recovery completion, what ongoing action is essential for incident closure?

Deleting all incident logs

Monitoring for anomalies and implementing preventive measures

Removing security patches

Disabling audit logging

3. What is a key difference between containment and eradication?

Containment stops spread; eradication removes the threat

Eradication is faster than containment

Containment requires more resources

They are the same process

4. During incident containment, which communication channel should be used if the network is compromised?

Email only

Out-of-band communication (phone, radio)

Social media

Text messages

5. What is the main purpose of validating system functionality after recovery?

To generate incident reports

To ensure no data loss and systems work as expected

To satisfy user requests

To test backup procedures

6. Which containment decision prioritizes business continuity over forensic preservation?

Partial containment with monitoring

Full air-gap isolation

Complete network shutdown

Malware quarantine only

7. What post-recovery activity helps detect if an attacker left backdoors?

User training

Continuous monitoring and log review

Scheduled backups

Hardware refresh

8. During eradication, why is it important to identify the attack vector?

To blame the user

To prevent similar attacks in the future

To calculate incident costs

To meet compliance deadlines

9. What is a critical consideration when deciding between rebuild and restore during recovery?

The color of the system case

Backup integrity and time available

The operating system version only

User preference

10. Which containment approach is most effective for ransomware incidents?

Immediate system shutdown

Network isolation to prevent propagation

Running decryption tools

Enabling administrative shares

11. What is the primary goal of the containment phase in incident response?

Prevent further damage and limit the scope of the incident

Remove all malware from infected systems

Restore systems to normal operations

Document all evidence for legal proceedings

12. What should be done with systems confirmed to be compromised before bringing them back online?

Clear browser cache and cookies

Rebuild or restore from clean backups

Run a quick antivirus scan

Update system date and time

13. Which technique prevents re-infection during the recovery phase?

Monitoring network traffic

Applying patches and security updates

Restoring from backup

Disabling user accounts

14. What is a 'golden image' in the context of system recovery?

A backup of encrypted data

A reference image of a clean, secure system state

A compressed archive of system files

A snapshot of network traffic

15. During incident response, which phase should prioritize preserving evidence?

Containment

Eradication

Recovery

All phases equally

16. What is the purpose of creating a clean baseline image before recovery?

To document system configuration

To ensure systems are restored to a known-good state

To speed up the recovery process

To comply with regulatory requirements

17. Which recovery step verifies that systems function correctly after remediation?

Patch management

System hardening

Validation testing

Log analysis

18. What does 'air-gapping' mean in incident containment?

Physically disconnecting systems from all networks

Reducing network bandwidth

Installing firewalls on all devices

Encrypting all network traffic

19. During eradication, what is the most critical step to ensure complete threat removal?

Restart all affected systems

Identify and remove the root cause of compromise

Update antivirus signatures

Backup infected files

20. Which containment strategy isolates affected systems while maintaining network connectivity for analysis?

Full isolation

Segmentation

Air-gapping

Quarantine

CySA+ Containment Eradication and Recovery Steps Quiz