Eradication addresses the root causes and malicious mechanisms that allow an attacker to remain inside the environment. Typical eradication actions include deleting malware, removing persistence mechanisms, disabling unauthorized accounts, resetting compromised credentials, eliminating malicious scheduled tasks or services, correcting exploited vulnerabilities, and rebuilding systems when trust cannot be restored.
This differs fundamentally from containment. Containment is intended to limit immediate damage or prevent further spread , such as isolating an infected workstation, blocking an IP address, disabling a network segment, or temporarily suspending an account. These measures can interrupt attacker activity, but they do not necessarily remove the underlying foothold. Microsoft security architecture guidance similarly distinguishes containment from eradication and describes eradication procedures as completely removing the threat from the environment.
Detection identifies that suspicious or malicious activity exists; it does not remove access. Denial of service is an attack or availability condition rather than a recognized incident-response phase.
Therefore, if the examination asks which phase permanently removes the adversary's access , the correct answer is eradication because this is where attacker persistence and the enabling compromise are eliminated before normal operations are fully restored.
Study Guide Reference: Incident Response and Management → Containment → Eradication → Persistence Removal → Credential Reset → Malware Removal → Vulnerability Remediation.
