easyMultiple ChoiceObjective-mapped
200-201 Practice Question: A company's security policy requires that all…
A company's security policy requires that all laptops accessing the corporate network must have full-disk encryption enabled. During a routine audit, an analyst discovers that a manager's laptop does not have encryption enabled. What is the most appropriate first step according to standard security incident response procedures?
⚠ Common exam trap
Cisco often tests the distinction between 'immediate containment' and 'proper escalation' in incident response, trapping candidates who confuse a policy violation with an active security breach requiring urgent network disconnection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the finding and escalate to the incident response team.
The first step in standard incident response procedures (as defined by NIST SP 800-61 and Cisco's IR framework) is to document the finding and escalate to the incident response team. This ensures that the potential policy violation is formally recorded and that trained responders can assess the risk, determine if sensitive data was exposed, and coordinate remediation without prematurely destroying evidence or causing operational disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disconnect the laptop from the network immediately.
Why it's wrong here
Immediate disconnection may disrupt business operations and is not the first step without assessment.
- ✓
Document the finding and escalate to the incident response team.
Why this is correct
Proper procedure is to document and escalate; the IR team will handle remediation.
- ✗
Install encryption software on the laptop without notifying the user.
Why it's wrong here
Unauthorized changes violate change management and may cause data loss.
- ✗
Wipe the laptop and reinstall the operating system.
Why it's wrong here
This is an extreme measure that should only be taken after a full investigation.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.