A security analyst identifies an incident in the network. Which of the following incident response activities would the security analyst perform next?

The correct answer is A. Containment. After identifying (detecting) an incident, the next step is containment, which aims to limit the spread and impact of the threat before proceeding to eradication or recovery.

Submitted by marco_it· Mar 6, 2026Security Operations

Question

Options

AContainment
BDetection
CEradication
DRecovery

How the community answered

(53 responses)

A
72% (38)
B
9% (5)
C
4% (2)
D
15% (8)

Explanation

After identifying (detecting) an incident, the next step is containment, which aims to limit the spread and impact of the threat before proceeding to eradication or recovery.

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice