EC-Council Certified Incident Handler (ECIH) Practice Test

The process that is specifically focused on removing malware and isolating infected systems is eradication. This step is vital during an incident response, as it aims to eliminate the underlying cause of a security incident, which, in this case, is malware. Effective eradication includes not only removing the malicious software from infected devices but also ensuring that the systems are restored to their secure and operational states without the threat of recurrence.

In the context of incident response, eradication follows the identification and containment phases. During identification, the nature and extent of the threat are determined, and during containment, measures are taken to limit the spread of the malware. Once containment is achieved, eradication becomes the focus to fully address the threat, making certain that any remnants of malware are thoroughly eliminated.

Detection relates to identifying signs of the malware’s presence, while recovery involves restoring affected systems and services to normal operations after the threat has been dealt with. Preparation encompasses the steps taken to ensure an organization is ready to handle incidents when they occur, including building an incident response plan and training staff.