Which of the following should be considered FIRST when responding to a major security breach?

The correct answer is A. Containment. The first action to consider when responding to a major security breach is containment. Containment helps to prevent further damage or spread of the breach, ensuring the issue is controlled before moving on to further steps like forensics or eradication. Once the breach is…

Submitted by renata2k· Apr 18, 2026Information Security Incident Management

Question

Options

AContainment
BForensics
CEradication
DDocumentation

How the community answered

(47 responses)

A
91% (43)
B
4% (2)
C
2% (1)
D
2% (1)

Explanation

The first action to consider when responding to a major security breach is containment. Containment helps to prevent further damage or spread of the breach, ensuring the issue is controlled before moving on to further steps like forensics or eradication. Once the breach is contained, the organization can then proceed with forensics to investigate the cause, eradication to remove the threat, and documentation for reporting and analysis.

Topics

#Incident Response Process#Containment#Security Breach Response

Community Discussion

No community discussion yet for this question.

Full CISM Practice