Which outcome is a characteristic of the recovery phase?

• A. Containment and eradication of the threat.
• B. System shutdown with no recovery plan.
• C. Enhanced data poisoning.
• D. No change in security posture.

Answer: (A)

During the recovery phase, the focus is on restoring normal operations and ensuring the environment is secure again so business services can run safely. A central result of this phase is confirming that the threat has been contained and eradicated, which means validating that all affected systems are clean, applying necessary remediation (like patches or reimaging), restoring data from trusted backups, and implementing monitoring to prevent a rebound of the incident. This confirmation that the threat is gone and the environment is stable allows the organization to return to service with confidence that it won’t be repeatedly compromised.

System shutdown with no recovery plan would halt operations permanently or indefinitely; recovery is about resuming operations, not stopping them. Enhanced data poisoning describes a worsening attack or data integrity issue, which is not a desired outcome of recovery. No change in security posture implies no lessons learned or improvements, whereas recovery typically involves verifying containment and eradication and then strengthening defenses to prevent recurrence.