Question 18
Main Page
Your company suffered a DDoS attack. Which phase of the incident response model focuses on returning systems to normal?
A. Identification
B. Containment
C. Recovery
D. Eradication
Answer: Recovery
The recovery phase involves restoring affected systems and returning to normal operations after containment and eradication.