Which component aims to remove the threat from the environment after containment?

• A. Detection
• B. Containment
• C. Analysis
• D. Eradication

Answer: (D)

Eradication is about removing the threat from the environment after containment. Once the incident is contained, the focus shifts to eliminating the malicious code, removing any backdoors or persistence mechanisms, cleaning affected systems, and addressing the underlying vulnerability or misconfiguration to prevent reinfection. This step ensures remnants of the attack are removed so normal operations can be safely restored.

Detection identifies that something is wrong, not the action of removing the threat. Analysis involves understanding what happened, scope, and impact. Containment limits the spread by isolating affected systems, but it doesn’t remove the threat itself—eradication does.