Which of the following is the MOST important component of the containment phase of an incident response plan?

Question

Options

• AClearly defined incident response playbooks
• BEscalation of incident response to senior management
• CCollection of indicators of compromise (IoCs)
• DIncident triage procedures

• A
  56% (23)
• B
  5% (2)
• C
  27% (11)
• D
  12% (5)

Explanation

Clearly defined incident response playbooks are the most critical containment component because they provide responders with pre-tested, step-by-step actions to stop an incident from spreading - without playbooks, teams improvise under pressure, leading to inconsistent or incomplete containment. Option B (escalation to senior management) is a communication/governance activity that spans the entire incident lifecycle, not something unique to or defining of the containment phase. Option C (IoC collection) belongs primarily to the identification/analysis phases - you gather indicators to understand the threat, but this precedes or runs parallel to containment rather than being its core component. Option D (triage procedures) also precedes containment; triage classifies and prioritizes the incident during the detection/identification phase before containment actions begin.

Memory tip: Think of containment as "follow the script" - a playbook is literally the script. When the clock is ticking, you don't want responders guessing; you want them executing a validated procedure.

No community discussion yet for this question.