312-39V2: Certified SOC Analyst v2

Question

GlobalTech’s SOC team has just completed patching a critical vulnerability that was exploited during a ransomware attack. The team is now restoring 2.3TB of encrypted data from its Veeam backup system, rebuilding 23 compromised workstations identified through SIEM logs, and re-enabling network access for the finance department after confirming the systems are clean. Which Incident Response phase is this?

Explanation

The Recovery phase returns affected systems and business operations to normal after the threat has been removed. Restoring encrypted data, rebuilding compromised workstations, validating that systems are clean, and re-enabling department network access are recovery activities.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ20

Community Discussion