CISM · Question #225
Which of the following should be the NEXT step after a security incident has been reported?
The correct answer is C. Containment. In the standard incident response lifecycle, containment immediately follows the reporting/identification phase. The goal is to limit the blast radius - stopping the spread of malware, isolating affected systems, or cutting off attacker access - before the situation worsens…
Question
Which of the following should be the NEXT step after a security incident has been reported?
Options
- AEscalation
- BInvestigation
- CContainment
- DRecovery
How the community answered
(58 responses)- A7% (4)
- B3% (2)
- C88% (51)
- D2% (1)
Explanation
In the standard incident response lifecycle, containment immediately follows the reporting/identification phase. The goal is to limit the blast radius - stopping the spread of malware, isolating affected systems, or cutting off attacker access - before the situation worsens. Investigation (B) and recovery (D) come after containment. Escalation (A) may happen in parallel but is not the primary action; stopping ongoing damage is. Acting before containing allows an active threat to continue causing harm during the response.
Topics
Community Discussion
No community discussion yet for this question.