Which of the following is the MOST appropriate action during the containment phase of a cyber incident response?

The correct answer is A. Isolate affected systems to prevent the spread of damage. The containment phase focuses on limiting the scope of the incident. Isolating affected systems immediately helps prevent propagation and further compromise. "During the containment phase, isolating compromised systems is a key tactic to minimize further impact and enable safe re

Submitted by fatema_kw· Apr 18, 2026Information Security Incident Management

Question

Options

AIsolate affected systems to prevent the spread of damage
BDetermine the final root cause of the incident
CMitigate exploited vulnerabilities to prevent future incidents
DRemove all instances of the incident from the network

How the community answered

(33 responses)

A
88% (29)
B
6% (2)
C
3% (1)
D
3% (1)

Explanation

The containment phase focuses on limiting the scope of the incident. Isolating affected systems immediately helps prevent propagation and further compromise. "During the containment phase, isolating compromised systems is a key tactic to minimize further impact and enable safe recovery."

Topics

#Incident Response#Containment Phase#Cyber Incident Management#Incident Lifecycle

Community Discussion

No community discussion yet for this question.

Full CISM Practice