Which of the following is an example of a remediation step?

• A. Block malicious IP addresses
• B. Rebuild compromised systems
• C. Blackhole malicious domain names
• D. Coordinate with cloud and service providers

Answer: (C)

Remediation steps are actions that directly reduce the attacker’s foothold and prevent reoccurrence. Blackholing malicious domain names is a remediation because it blocks the attacker’s infrastructure from reachable communications by preventing DNS resolutions for those domains. Implementing DNS sinkholing or domain-based filtering disrupts malware’s ability to contact command-and-control servers or receive instructions, cutting off the external channel the threat uses. This can be applied quickly across the environment and targets the root cause of ongoing compromise—the reachability of malicious hosts.

Blocking IP addresses is a mitigation that can be effective but may be evaded as attackers switch IPs or use domain-based infrastructure. Rebuilding compromised systems is a comprehensive recovery/eradication effort and, while essential, is more resource-intensive and follows containment and eradication. Coordinating with cloud and service providers is important for broader response but isn’t a concrete remediation action by itself.