Which component involves removing the threat from the environment after containment?

• A. Detection
• B. Eradication
• C. Recovery
• D. Analysis

Answer: (B)

The main idea being tested is removing the threat from the environment after containment. This step is about eliminating the attacker’s presence and any tools, backdoors, or infected components they left behind. Practically, it includes removing malware, cleaning or reimaging affected systems, disabling compromised accounts, applying patches, and hardening defenses to prevent recurrence. After this removal, recovery can begin to bring systems back to normal operations, validate they’re clean, and monitor for any signs of residual activity. Detection focuses on finding that something is wrong, while analysis aims to understand how and why it happened, so they aren’t the actions that actually eliminate the threat.