Which of the following is the FIRST step in the incident response process?

Determining the root cause is part of the later analysis or post-incident activity phase, not the first step, as you must first confirm an incident exists before performing root cause analysis.

Disconnecting a system from the network is a containment action that occurs after the incident has been identified and confirmed, and premature disconnection can destroy volatile forensic evidence.

Isolating and containing the affected system is the second major phase of incident response, which only begins after the incident has been identified and verified through initial investigation.

Before any containment or remediation action is taken, the incident response process requires that all symptoms be investigated to confirm a real incident is occurring. This identification phase ensures responders are not reacting to false positives and allows them to understand the scope and nature of the incident, which informs all subsequent steps such as containment, eradication, and recovery.