The organization remains in the eradication phase because malicious artifacts are still being removed from affected systems and the environment has not yet reached a trusted state suitable for complete restoration. The phrase “removing malware from some of the affected hosts” indicates that responders are actively eliminating the threat across the compromised estate rather than merely observing or documenting it.

Eradication addresses malware, attacker persistence, exploited vulnerabilities, unauthorized accounts, malicious configurations, compromised credentials, and other mechanisms that could permit reinfection or renewed access. Only after responders have sufficiently eliminated those causes should affected resources progress fully into recovery and return to normal operation. NIST's current incident-response model identifies containment, eradication, and recovery as related but distinct activities and emphasizes restoring assets only after appropriate incident handling has occurred.

Detection would have occurred when the incident was initially discovered. Analysis determines scope, cause, and impact. Preparation takes place before incidents by establishing plans, tools, procedures, and capabilities. Post-incident activities occur after response and restoration and focus on organizational improvement.

The two-week duration does not determine the phase. The activity being performed does : continued removal of malware indicates eradication.

Study Guide Reference: Incident Response and Management → Containment → Eradication → Malware Removal → Persistence Removal → System Validation → Recovery.

The CIO is implementing risk avoidance because the organization is eliminating the activity or technology that creates the risk. The legacy system no longer receives security updates, so continued operation would maintain exposure to vulnerabilities that may eventually become impossible to remediate. By phasing out and ultimately decommissioning the system, the organization removes that source of risk instead of continuing to operate it under additional controls.

NIST recognizes acceptance, avoidance, mitigation, sharing, and transfer as established risk-response approaches. Avoidance differs from mitigation because mitigation would retain the legacy system while implementing controls that reduce its likelihood or impact—for example, segmentation, strict access controls, application allowlisting, or enhanced monitoring.

Risk acceptance would involve deliberately continuing to operate the system after management acknowledges and approves the remaining exposure. Risk transference would shift some financial or operational consequences to another party, such as through insurance or contractual arrangements.

The phrase “phase out” is the decisive indicator. The organization intends to stop using the risk-producing technology entirely, making avoidance the most precise classification.

Study Guide Reference: Vulnerability Management → Risk Management → Risk Responses → Avoidance → Mitigation → Acceptance → Transference → Legacy and End-of-Life Systems.

The recurring weekly conference call is intended to manage and facilitate team coordination . The analyst's stated objectives are to understand workflow processes and the capabilities of the engineers participating in the cybersecurity improvement project. Regular coordination meetings provide a structured mechanism for sharing operational updates, clarifying responsibilities, identifying dependencies, communicating blockers, aligning technical activities, and understanding which personnel possess the expertise required for particular tasks.

Nothing in the scenario indicates an incident requiring formal incident-response training. Training would normally involve exercises, tabletop scenarios, simulations, procedures, or instruction designed to build response capability. There is also no vendor involvement, so a vendor information session would not satisfy the stated objective. Likewise, no customer request is identified.

The distinguishing clue is the combination of a cross-functional task force, workflow understanding, skills visibility, and recurring communication . These elements support internal project coordination rather than external communication or formal instruction.

Within CySA+, reporting and communication extends beyond writing final reports. Analysts must communicate effectively with technical teams, coordinate activities with relevant stakeholders, provide appropriate status information, and ensure security work is understood and actionable across organizational functions.

Study Guide Reference: Reporting and Communication → Stakeholder Communication → Team Coordination → Roles and Responsibilities → Workflow Management → Cross-Functional Collaboration.

AI usage policies establish organizational boundaries for how artificial intelligence systems may be selected, accessed, configured, and used. They allow an organization to obtain operational benefits from AI while controlling risks involving confidential information, intellectual property, regulated data, model outputs, external AI services, and inappropriate automation. A strong policy can define approved platforms, prohibited data categories, validation requirements, human oversight, retention rules, acceptable use, and escalation procedures.

Prompt engineering is a technical method for constructing inputs that produce more useful model responses. It can improve output quality but does not establish enterprise-wide safeguards for protecting business objectives or sensitive information. A non-disclosure agreement establishes contractual confidentiality obligations between parties; it cannot govern the full technical and operational use of AI systems. An incident response policy determines how security incidents are managed and escalated, but it is reactive and not designed to establish routine AI governance.

CS0-004 explicitly addresses AI within Security Operations. The objectives identify AI risks including hallucinations, data exposure, model poisoning, and malicious prompts and identify governance considerations including legal or regulatory compliance and AI usage policies . AI use cases include log analysis, artifact comparison, incident investigation, event correlation, and automation.

Study Guide Reference: Security Operations → AI in Security Operations → AI Risks → Governance → AI Usage Policies → Data Protection.