nerdexam
(ISC)2

SSCP · Question #437

In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?

The correct answer is D. Analysis and tracking. In this step, your main objective is to examine and analyze what has occurred and focus on determining the root cause of the incident. Recovery is incorrect as recovery is about resuming operations or bringing affected systems back Containment is incorrect as containment is…

Submitted by helene.fr· Apr 18, 2026Incident Response and Recovery

Question

In the course of responding to and handling an incident, you work on determining the root cause of the incident. In which step are you in?

Options

  • ARecovery
  • BContainment
  • CTriage
  • DAnalysis and tracking

How the community answered

(65 responses)
  • A
    8% (5)
  • B
    2% (1)
  • C
    3% (2)
  • D
    88% (57)

Explanation

In this step, your main objective is to examine and analyze what has occurred and focus on determining the root cause of the incident. Recovery is incorrect as recovery is about resuming operations or bringing affected systems back Containment is incorrect as containment is about reducing the potential impact of an incident. Triage is incorrect as triage is about determining the seriousness of the incident and filtering out

Topics

#Incident Response#Root Cause Analysis#Incident Handling#Incident Response Phases

Community Discussion

No community discussion yet for this question.

Full SSCP Practice