Which of the following is the MOST important consideration when developing an approach to effectively contain security incidents?

The correct answer is B. Isolating systems impacted by incidents from the production environment. Isolating impacted systems from the production environment is the most important technical consideration for containment because it directly stops the spread of the incident-preventing lateral movement, further data exfiltration, or additional system compromise. Containment's…

Submitted by haru.x· Apr 18, 2026Information Security Incident Management

Question

Options

AAssigning senior management accountability for incident containment
BIsolating systems impacted by incidents from the production environment
CMitigating reputational damage that may affect business
DMinimizing financial losses that may result from outages

How the community answered

(22 responses)

A
5% (1)
B
77% (17)
C
5% (1)
D
14% (3)

Explanation

Isolating impacted systems from the production environment is the most important technical consideration for containment because it directly stops the spread of the incident-preventing lateral movement, further data exfiltration, or additional system compromise. Containment's core objective is to limit the scope of damage. Option A (senior management accountability) is a governance consideration, not a containment action. Option C (mitigating reputational damage) and Option D (minimizing financial losses) are business outcomes that result from effective containment, not containment strategies themselves. Without technical isolation, the incident continues to expand regardless of management oversight or financial awareness.

Topics

#Incident Containment#Incident Response#System Isolation#Security Operations

Community Discussion

No community discussion yet for this question.

Full CISM Practice