ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Eradication focuses on removing the root cause of an incident and eliminating any malicious artifacts that were introduced. Because the attackers tampered with the package repository, the integrity of all installed software on the affected EC2 instances is in doubt. The most reliable way to ensure complete removal of the compromised binary-and any other undetected modifications-is to rebuild each instance from a known-good, hardened Amazon Machine Image (AMI) and then reinstall required software using validated package signatures. Simply patching or deleting the suspect file on the running systems (other options) risks leaving backdoors or additional malicious files in place. Capturing additional forensic data can be valuable, but that step belongs to the analysis phase and should have been completed before containment ended; it does not remove the root cause. Therefore, redeploying clean, trusted images and verifying package integrity is the appropriate eradication action.