Containment, Eradication, Recovery and Lessons Learned
This topic covers response life cycle preparation, containment, eradication, recovery, communications, root cause, lessons learned, playbook updates, and post-incident activity.
How to study for CompTIA CySA+
Treat each CySA+ item as an analyst decision: identify telemetry, scope risk, validate findings, contain impact, communicate clearly, and improve controls.
Core concepts
Concept 1
Containment limits damage while balancing evidence, service impact, and attacker behavior.
Exam cue: Contain without destroying evidence or creating avoidable outage.
Concept 2
Eradication and recovery should remove root cause, restore trusted operations, validate health, and monitor for recurrence.
Exam cue: Recover from trusted sources and validate health.
Concept 3
Post-incident activity improves detection, controls, playbooks, training, and communication.
Exam cue: Convert lessons learned into updated controls and playbooks.
Risk pitfalls and guardrails
Restoring compromised systems without removing persistence.
Guardrail: Avoid answers that destroy evidence, trust scanner output blindly, over-automate containment, omit stakeholders, or report raw tool noise as strategy.
Skipping monitoring after recovery.
Guardrail: Avoid answers that destroy evidence, trust scanner output blindly, over-automate containment, omit stakeholders, or report raw tool noise as strategy.
Treating lessons learned as a formality rather than improvement work.
Guardrail: Avoid answers that destroy evidence, trust scanner output blindly, over-automate containment, omit stakeholders, or report raw tool noise as strategy.
Memory anchors
Preparation
Preparation builds playbooks, roles, tools, contacts, and training before incidents occur.
Containment
Containment limits spread or damage while response continues.
Eradication
Eradication removes malware, persistence, vulnerable entry points, and unauthorized access.
Recovery
Recovery restores services from trusted sources and validates normal operations.
Root Cause
Root cause identifies why the incident happened, not merely how service was restored.
Lessons Learned
Lessons learned identify improvements after an incident.
Playbook Update
A playbook update turns experience into repeatable future response steps.
Credential Reset
Credential reset reduces attacker access after suspected compromise.
Monitoring Window
A monitoring window watches for recurrence after recovery.
Communication Plan
A communication plan defines who receives incident updates, when, and through which channel.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
Aster Bank's responders discover that the contact list and playbook for a cloud compromise have not been tested in two years. Which recommendation is MOST appropriate? No response action has been taken yet.
Ransomware is encrypting a workstation at Canyon Transit and reaching file shares, while EDR remains responsive. What should the analyst do FIRST? No response action has been taken yet.
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”