(ISC)2
CCSP · Question #882
What does an organization usually do first when starting a formal incident response?
The correct answer is B. Identify and declare the incident. The first operational step is to detect and confirm that an incident has occurred. Only after identification do teams move on to contain, eradicate, and recover.
Submitted by haruto_sh· Apr 18, 2026Cloud Security Operations
Question
What does an organization usually do first when starting a formal incident response?
Options
- AImmediately notify law enforcement
- BIdentify and declare the incident
- CEradicate the threat
- DRestore from backup
How the community answered
(24 responses)- B88% (21)
- C4% (1)
- D8% (2)
Explanation
The first operational step is to detect and confirm that an incident has occurred. Only after identification do teams move on to contain, eradicate, and recover.
Topics
#Incident Response Process#Incident Detection#Incident Management#Security Operations
Community Discussion
No community discussion yet for this question.