During incident containment, which action is correct?

Question

BlackTom AI · Accepted Answer

When evaluating actions during incident containment, we need to consider actions that limit spread and preserve evidence rather than destroy information.
Option a: Erase logs. This is typically inappropriate during containment because it destroys forensic evidence and hampers incident investigation, making it harder to trace the breach and learn from it. Logs are essential for understanding scope and impact.
Option b: Notify press. Public communications are often coordinated through an incident response or communications plan. Premature or unapproved disclosure can cause confusion, panic, and reveal sensitive details; containment focuses on technical steps first.
Option c: Shutdown network. While isolating affected segments is important, a blanket network shutdown is drastic and can disrupt critical services and operations. Containment aims to minimize impact while containing the incident, not necessarily taking the entire network offline.
Option d: Isolate infected hosts. This targets the source of the outbreak by removing compromised machines from the broader network, preventing lateral movement and further spread while investigators assess and remediate the incident. This aligns with standard containment practices.
Thus, the action that best supports containment objectives is to isolate infected hosts, ensuring containment without unnecessary disruption or data loss.

Ethical Hacking and Incident Response (082025-ZED)

During incident containment, which action is correct?

View Explanation

Log in for full answers

Similar Questions

Question at position 19 When the attack is minor and unlikely to escalateWhen the root cause of the incident has been identified and requires extensive remediationWhen an organization has unlimited resourcesWhen there is a lack of skilled personnel to manage the incident

Question at position 17 NIST Special Publication 800-61r1 NIST Special Publication 800-61r2 NIST Special Publication (SP) 800-53NIST Special Publication 800-86

Question at position 8 By identifying the types of incidents that might occurBy establishing the budget for cybersecurity measuresBy mapping out potential escape routes for personnelBy pre-defining containment strategies for different types of incidents

Question at position 4 Creating well-defined procedures and checklistsFocusing solely on detection mechanismsPurchasing additional security softwareHiring more staff

Question at position 23 System configuration filesEmails from the target’s inboxFinancial data of the organizationUser account informationClear my selection

More Practical Tools for Students Powered by AI Study Helper

Homework AI Solver

Stylized AI Paper Writer

Plagiarism Checker Assistant

Citation AI Academic Writing Tool

In-Class Translation Assistant

AI Note Generator

AI Quiz Answers

Past Exam Questions from University Test Bank

Smart Practice Assistant

Adaptive Practice

Making Your Study Simpler