What is the end goal of a remediation event?

• A. Purge the adversary from the network
• B. Publish a report
• C. Launch a new threat hunting approach
• D. Install new monitoring software

Answer: (A)

Remediation aims to purge the adversary from the network and restore a trusted, secure state. This means eradicating the attacker’s presence and artifacts, removing persistence mechanisms, closing exploited paths, rotating credentials, patching vulnerabilities, and, if needed, reimaging compromised systems. The goal is to return operations to normal with reinforced defenses so the environment isn’t immediately re-compromised. While documenting what happened, publishing a report, launching follow-on threat-hunting efforts, or installing new monitoring can occur as part of the broader incident response lifecycle, they are not the primary objective of the remediation itself.