iSACA Cybersecurity Fundamentals Certification Practice Exam

Which of the following is the focus of the incident response phase known as mitigation?

1. Determining the root cause of the incident

2. Recovering from the adverse event

3. Preparing for future incidents

4. Removing malware from systems

The correct answer is: Recovering from the adverse event

The focus of the mitigation phase in incident response is primarily on reducing the impact of an incident and rectifying the immediate threats to the environment. This includes actions taken to limit the damage caused by an adverse event and to stabilize systems and networks that have been affected. Mitigation involves specific strategies such as deploying fixes for vulnerabilities, applying patches, or removing threats like malware to minimize further risk and potential disruption to operations. It aims to restore functionality and ensure that systems can return to normal operations as quickly and safely as possible. While recovering from the incident may involve elements related to mitigation, it is more accurately characterized as the phase following mitigation, where efforts are focused on bringing systems back online fully and ensuring they are secure. Other options, such as determining the root cause or preparing for future incidents, pertain to analysis and proactive measures but do not specifically address the immediate actions required to mitigate an ongoing or recent incident.