Which of the following is an objective of incident containment procedures?

The correct answer is C. Minimizing further impact. Containment is a phase in the incident response lifecycle that occurs after detection and analysis. Its primary goal is to stop the spread of damage and limit the incident's scope - minimizing further impact to systems, data, and operations. It is not about preventing future…

Submitted by sofia.br· Apr 18, 2026Information Security Incident Management

Question

Options

APreventing future incidents
BAttempting to neutralize the attack
CMinimizing further impact
DDetermining the severity of an incident

How the community answered

(33 responses)

B
6% (2)
C
91% (30)
D
3% (1)

Explanation

Containment is a phase in the incident response lifecycle that occurs after detection and analysis. Its primary goal is to stop the spread of damage and limit the incident's scope - minimizing further impact to systems, data, and operations. It is not about preventing future incidents (A, which is the goal of post-incident lessons learned), fully neutralizing the attack (B, which is eradication), or determining severity (D, which is part of the identification/analysis phase).

Topics

#Incident containment#Incident response#Incident management objectives

Community Discussion

No community discussion yet for this question.

Full CISM Practice