Which of the following activities occurs in the incident containment phase?

The correct answer is B. Obtaining and preserving evidence. Obtaining and preserving evidence (B) is the correct answer because containment focuses on limiting the damage of an incident while simultaneously securing forensic artifacts - logs, memory dumps, disk images - before they are altered or destroyed. This dual goal (stop the…

Submitted by stefanr· Apr 18, 2026Information Security Incident Management

Question

Options

AConfirming the authenticity and impact
BObtaining and preserving evidence
CRestoring system operations
DConducting a root cause analysis

How the community answered

(19 responses)

B
89% (17)
C
5% (1)
D
5% (1)

Explanation

Obtaining and preserving evidence (B) is the correct answer because containment focuses on limiting the damage of an incident while simultaneously securing forensic artifacts - logs, memory dumps, disk images - before they are altered or destroyed. This dual goal (stop the spread, save the proof) is the defining characteristic of the containment phase.

Why the distractors are wrong:

A (Confirming authenticity and impact) happens during identification/detection - you verify and scope the incident before you contain it.
C (Restoring system operations) belongs to the recovery phase, which comes after containment and eradication.
D (Root cause analysis) is a post-incident activity performed during the lessons-learned or analysis phase.

Memory tip: Think of containment as "freeze and capture" - you freeze the spread and capture evidence. The phases in order are: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned (mnemonic: PICERL). Anything about gathering clues/evidence belongs in Containment; anything about fixing or restoring belongs later.

Topics

#Incident Response#Containment Phase#Evidence Preservation#Incident Management

Community Discussion

No community discussion yet for this question.

Full CISM Practice