[&] Which of the following is an example of a short-term containment action?
- Implementing more robust monitoring mechanisms
- Patching vulnerable systems
- Disconnecting affected devices from the network
- Rebuilding systems with hardened configurations

[&] What is the primary goal of the containment phase in incident response?
- Restore all systems to normal operations
- Limit the scope and impact of the incident
- Eliminate all threats immediately
- Identify potential vulnerabilities in the system

[&] Which activity is part of the eradication process?
- Short-term containment
- Business continuity planning
- Artifact removal
- Incident detection

[&] What is the main purpose of the eradication phase in the incident response process?
- To ensure the organization's operations remain uninterrupted
- To limit the attacker's ability to access additional systems
- To prevent attackers from re-entering the system
- To remove the root cause and persistence mechanisms of the incident

[&] During the eradication phase, why is log analysis important?
- To identify lingering malicious activity and validate successful remediation
- To create a backup of all system logs
- To correlate events and refine detection rules for future incidents
- To generate reports that enhance incident response processes