Which action is a remediation objective?

• A. Degrade the ability of the adversary to return
• B. Remove the presence of the adversary from the environment
• C. Eliminate the ability for the adversary to react to the remediation
• D. Deny access to the environment

Answer: (B)

In incident response, remediation is about returning systems to a clean, trusted state by removing the threat and its artifacts and restoring normal operations. The primary objective is to eliminate the adversary’s presence from the environment, which includes eradicating malware, closing backdoors, removing stolen credentials, and patching or reconfiguring affected systems so the threat cannot persist or re-enter.

This focus on removing the intruder makes the environment verifiably clean and safe again, which is the essential milestone that signals remediation is complete and recovery can proceed. While other actions—such as hindering the attacker’s ability to return, preventing the attacker from reacting to remediation, or simply denying access—are valuable preventive or strategic controls, they do not by themselves fulfill the remediation goal of fully clearing the environment of attackers and their artifacts.