Which of the following is the MOST appropriate action during the containment phase of a cyber incident response?

The correct answer is B. Isolate affected systems to prevent the spread of damage. The containment phase focuses on limiting the scope and preventing further damage. Isolating affected systems stops propagation and preserves the environment for investigation, whereas eradication, remediation, and root cause determination occur later.

Submitted by jakub_pl· Apr 18, 2026Information Security Incident Management

Question

Options

ARemove all instances of the incident from the network.
BIsolate affected systems to prevent the spread of damage.
CMitigate exploited vulnerabilities to prevent future incidents.
DDetermine the final root cause of the incident.

How the community answered

(19 responses)

B
89% (17)
C
5% (1)
D
5% (1)

Explanation

The containment phase focuses on limiting the scope and preventing further damage. Isolating affected systems stops propagation and preserves the environment for investigation, whereas eradication, remediation, and root cause determination occur later.

Topics

#Cyber Incident Response#Incident Management Phases#Containment Phase#System Isolation

Community Discussion

No community discussion yet for this question.

Full CISM Practice