An information security manager has been notified about a compromised endpoint device. Which of the following is the BEST course of action to prevent further damage?

The correct answer is D. Isolate the endpoint device. Isolating the endpoint device prevents the malware or attack from spreading to other systems while preserving it for further investigation. This containment step is crucial to stopping further damage while allowing forensic analysis and remediation. Powering off or erasing the…

Submitted by klara.se· Apr 18, 2026Information Security Incident Management

Question

Options

APower off the endpoint device.
BSecurely erase the endpoint device.
CPatch the endpoint device.
DIsolate the endpoint device.

How the community answered

(46 responses)

A
9% (4)
B
13% (6)
C
4% (2)
D
74% (34)

Explanation

Isolating the endpoint device prevents the malware or attack from spreading to other systems while preserving it for further investigation. This containment step is crucial to stopping further damage while allowing forensic analysis and remediation. Powering off or erasing the device may destroy critical evidence, and patching should be done only after understanding the nature of the

Topics

#Incident Response#Containment#Endpoint Security#Immediate Action

Community Discussion

No community discussion yet for this question.

Full CISM Practice