Certified Information Security Manager CISM · Free Practice Question Easy
Question 92
Security incident responders have identified a malware attack on a specific server. Incident responders removed the server from the network. Which step in security incident response has been performed?
- A Containment
- B Identification
- C Eradication
- D Isolation
Reveal correct answer
Correct answer: A
Explanation
Correct Answer:
Containment is correct. By removing the server from the network, the incident can be considered to have been contained. This, of course, assumes that no other systems in the environment are affected.
Incorrect Answers:
Isolation is incorrect because Isolation is not a standard term used in security incident response.
Eradication is incorrect because the malware has not been eradicated (removed), but only Contained.
Identification is incorrect because the malware has likely already been identified.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
