In the Resolve phase, restoring systems from a _____ is one way to eradicate an intrusion.

### Why this is right The Resolve phase includes eradicating an intrusion by restoring systems from a backup. The material also calls for scanning systems and connected devices and patching discovered vulnerabilities. ### The concept A backup is a copy of data or systems that can support restoration when the original environment has been affected. Restoration is one part of response, not the whole process: responders first need to understand and contain the issue, and they should also address the intrusion and vulnerabilities that could allow it to recur. Evidence and supporting documentation should be preserved during the response. ### Terms - **Eradicate**: Remove the intrusion or its presence from the affected environment. - **Vulnerability**: A weakness that can be exploited to compromise a system, device, or network. ### Remember Restoring a copy helps recovery, but resolve also includes containment, scanning, patching, and evidence preservation.