712-50 · Question #42
When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?
The correct answer is D. Containment. Containment is the correct first step because the immediate priority when an incident is detected is to stop the spread of damage - isolating affected systems prevents the threat from compromising additional assets before you fully understand what you're dealing with…
Question
When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?
Options
- AEscalation
- BRecovery
- CEradication
- DContainment
How the community answered
(44 responses)- A14% (6)
- B5% (2)
- C7% (3)
- D75% (33)
Explanation
Containment is the correct first step because the immediate priority when an incident is detected is to stop the spread of damage - isolating affected systems prevents the threat from compromising additional assets before you fully understand what you're dealing with.
Escalation (A) happens during or after containment, not before - you need to first stop the bleeding, then notify the right people. Recovery (B) comes near the end of the process, after the threat has been neutralized and systems are safe to restore. Eradication (C) also follows containment - you can only remove the root cause (malware, attacker access) after you've isolated the affected environment.
Memory tip: Think of incident response like a fire - you contain the fire first (close the doors, pull the alarm), then eradicate it (put it out), then recover (repair the damage). You don't rebuild the house while it's still burning.
Topics
Community Discussion
No community discussion yet for this question.