CISM · Question #25
Which of the following incident response phases involves actions to help safeguard critical systems while maintaining business operations?
The correct answer is A. Containment. The containment phase of incident response focuses on limiting the scope and impact of a security incident, safeguarding critical systems, and maintaining business operations by stopping the attack's spread.
Question
Which of the following incident response phases involves actions to help safeguard critical systems while maintaining business operations?
Options
- AContainment
- BIdentification
- CPreparation
- DRecovery
How the community answered
(48 responses)- A85% (41)
- B4% (2)
- C2% (1)
- D8% (4)
Why each option
The containment phase of incident response focuses on limiting the scope and impact of a security incident, safeguarding critical systems, and maintaining business operations by stopping the attack's spread.
The containment phase involves taking actions to prevent an incident from spreading further, isolating affected systems, and eradicating the threat to limit damage while simultaneously striving to maintain essential business operations. This phase is critical for minimizing the impact and preventing a complete operational shutdown.
Identification involves detecting and analyzing the incident, not actively safeguarding systems.
Preparation focuses on activities before an incident occurs, such as developing plans and training, rather than direct incident handling.
Recovery focuses on restoring systems and operations to their normal state after an incident has been contained and eradicated.
Concept tested: Incident response phases (Containment)
Source: https://learn.microsoft.com/en-us/security/compass/incident-response-overview
Topics
Community Discussion
No community discussion yet for this question.