ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
After isolating a compromised application server, the response team removes the attacker's web shell and applies the vendor security patch that corrects the exploited flaw. Before placing the host back into production, which additional remediation activity is most important to ensure complete eradication of the incident?
Reimage the server from a trusted, verified backup and validate its integrity before reconnecting it to the network.
Enable verbose logging and keep the current image to monitor for any remaining attacker activity.
Turn off network intrusion detection sensors to avoid interference with the restored production workload.
Notify affected customers and regulators of the breach before performing any further technical actions.
During the eradication and recovery phases, NIST SP 800-61 recommends that responders rebuild or restore affected hosts from trusted, verified media or backups and validate their integrity before reconnecting them to the production network. This step removes any residual malware, rootkits, or configuration changes the attacker may have left behind. Simply enabling extra logging (a monitoring action) does not guarantee the system is clean. Notifying customers or regulators is part of post-incident communication, not technical remediation, and disabling IDS sensors would actually reduce defensive visibility rather than aid recovery.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a web shell in cybersecurity?
Open an interactive chat with Bash
What is the purpose of reimaging a server during incident recovery?
Open an interactive chat with Bash
What is NIST SP 800-61, and why is it important in incident response?
Open an interactive chat with Bash
Why is reimaging the server from a trusted, verified backup crucial after an incident?
Open an interactive chat with Bash
What is NIST SP 800-61, and why is it relevant here?
Open an interactive chat with Bash
How can you validate the integrity of a server after restoring from a backup?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)