🛡️ Free practice test question from: Eradication (Security+)

A) Isolating affected systems: While important for containment, isolation only stops the spread of the current incident. It doesn't address the underlying vulnerability that allowed the incident to happen in the first place.

B) Implementing temporary workarounds: Workarounds are temporary fixes to restore functionality. They don't prevent the incident from recurring because the root cause is still present.

C) Identifying and mitigating the root cause: This directly addresses the core issue. By finding and fixing the vulnerability, the organization prevents the same type of incident from happening again. This could involve patching software, changing configurations, deleting infected files, disabling unnecessary services, or implementing new security controls.

D) Collecting and preserving evidence: While important for legal purposes and post-incident analysis, evidence collection doesn't prevent future occurrences.