hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A security analyst is reviewing the company's…
A security analyst is reviewing the company's incident response plan. The plan states that 'all incidents must be contained within 30 minutes.' During a recent ransomware incident, the analyst identified the affected systems but could not contain them because the containment procedures required manual steps that took over an hour. What is the most likely gap in the plan?
⚠ Common exam trap
Cisco often tests the distinction between a plan's stated objective and the operational capability to achieve it, trapping candidates who blame the analyst's performance or the threat's complexity instead of recognizing the missing automation in the procedures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The plan does not provide automated containment options.
The plan's requirement to contain incidents within 30 minutes is unachievable because the containment procedures rely solely on manual steps that take over an hour. The most likely gap is the absence of automated containment options, such as pre-configured firewall ACLs, host-based IPS policies, or SOAR playbooks that can isolate affected systems in seconds. Without automation, the response time objective (RTO) for containment is fundamentally mismatched with the procedural capability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ransomware was too sophisticated.
Why it's wrong here
The sophistication is not the gap; the plan must handle various threats.
- ✓
The plan does not provide automated containment options.
Why this is correct
The manual procedures are too slow to meet the 30-minute goal; automation or simpler steps are needed.
- ✗
The analyst lacked proper training.
Why it's wrong here
Training may be an issue, but the plan should be realistic.
- ✗
The analyst did not have proper authorization.
Why it's wrong here
Authorization should be pre-defined in the plan.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.