Exam 350-201 topic 1 question 118 discussion

ChatGPT: After the malware has been contained and the attacking host identified, the next logical step in the incident response workflow is eradication and recovery. This involves removing the malware from all affected systems and restoring the systems to a secure and operational state. It also includes ensuring that the systems are clean and no longer compromised.

The containment was already done, the SOC analyst stopped the Malware from spreading, which means that they contained the attack. Logic option would be Eradication and Recovery as next step.

SOC analyst was able to stop the malware from spreading. This means containment is already in place so next step should be eradicate and recovery.

The next step could be isolate

The next step in the incident response workflow after stopping the malware from spreading and identifying the attacking host is containment. The goal of containment is to isolate and limit the impact of the incident to prevent further damage or data loss. - ChatGPT