Identifying which of the following BEST enables a cyberattack to be contained?

The correct answer is A. The vulnerability exploited by the attack. Identifying the exploited vulnerability is the most actionable information for containing an attack because it directly reveals how the attacker gained or is maintaining access. Once the vulnerability is known, it can be patched, mitigated, or isolated, closing the attack vector

Submitted by manish99· Apr 18, 2026Information Security Incident Management

Question

Options

AThe vulnerability exploited by the attack
BThe segment targeted by the attack
CThe IP address of the computer that launched the attack
DThe threat actor that initiated the attack

How the community answered

(41 responses)

A
88% (36)
B
2% (1)
C
2% (1)
D
7% (3)

Explanation

Identifying the exploited vulnerability is the most actionable information for containing an attack because it directly reveals how the attacker gained or is maintaining access. Once the vulnerability is known, it can be patched, mitigated, or isolated, closing the attack vector and stopping further exploitation. Knowing the targeted network segment (B) helps with isolation but doesn't stop the attack if the vulnerability remains open. The attacker's IP address (C) can be blocked, but attackers easily rotate IPs. Knowing the threat actor (D) is useful for attribution and long-term defense but does not directly contain an active attack.

Topics

#Incident Response#Cyberattack Containment#Vulnerability Management#Security Incident Handling

Community Discussion

No community discussion yet for this question.

Full CISM Practice