Whack-a-mole in incident response describes which scenario?

Whack-a-mole in incident response describes which scenario?

• A. The organization blindly chases the attacker throughout the network, making little overall progress.
• B. Attackers leave no traces.
• C. The organization implements rigorous threat hunting before investigation.
• D. Whack-a-mole describes a diligent, methodical containment strategy.

Answer: (A)

Whack-a-mole describes a pattern where incident responders chase one indicator or symptom after another across the environment, removing one malicious instance only to see another appear elsewhere. This leads to reactive firefighting that doesn’t address the attacker’s footholds or persistence, so despite lots of activity there’s little overall progress. You’re effectively reacting to alerts, isolating or removing things in isolation, and never closing the underlying access paths the attacker uses, which allows them to re-enter or re‑establish footholds. In practice, you see scattered containment actions without a coordinated eradication plan, missed persistence mechanisms, and repeated cycles of reinfection or reoccurring access. To avoid this, focus shifts to targeted containment and eradication tied to a deliberate plan that closes persistence paths and neutralizes the attacker across the kill chain. The other descriptions don’t fit because attackers leaving no traces is unrealistic, rigorous threat hunting before investigation describes a proactive approach rather than episodic chasing, and a diligent, methodical containment strategy implies structured, preventive work rather than repetitive, reactive firefighting.

Whack-a-mole describes a pattern where incident responders chase one indicator or symptom after another across the environment, removing one malicious instance only to see another appear elsewhere. This leads to reactive firefighting that doesn’t address the attacker’s footholds or persistence, so despite lots of activity there’s little overall progress. You’re effectively reacting to alerts, isolating or removing things in isolation, and never closing the underlying access paths the attacker uses, which allows them to re-enter or re‑establish footholds.

In practice, you see scattered containment actions without a coordinated eradication plan, missed persistence mechanisms, and repeated cycles of reinfection or reoccurring access. To avoid this, focus shifts to targeted containment and eradication tied to a deliberate plan that closes persistence paths and neutralizes the attacker across the kill chain.

The other descriptions don’t fit because attackers leaving no traces is unrealistic, rigorous threat hunting before investigation describes a proactive approach rather than episodic chasing, and a diligent, methodical containment strategy implies structured, preventive work rather than repetitive, reactive firefighting.