200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Initiate the legal hold process to preserve evidence

  Why it's wrong here

  A legal hold preserves data for litigation and is invoked by legal counsel, not as an initial containment step. It is tempting because evidence preservation matters in incidents, but the analyst must first contain the threat, for example by disabling the targeted account or blocking the source IP, before any evidentiary procedures.

• ✗

  Contain the threat by blocking the IP address on the firewall

  Why it's wrong here

  Blocking the source IP is a containment step, which follows detection and analysis in the incident response lifecycle; the stem asks for the first action, so scoping and validating the alert must precede any firewall change. Blocking suits confirmed active attacks, not unverified SIEM alerts.

• ✗

  Escalate the alert to Tier 2 for deeper investigation

  Why it's wrong here

  Escalation transfers ownership but skips the analyst's initial triage and validation duties; Tier 2 handles complex, confirmed incidents requiring deep forensic work. Escalating an unverified brute-force alert would be premature, since first-line analysis must establish whether it is a true positive.

• ✓

  Perform initial triage to determine the severity and validity

  Why this is correct

  Triage validates whether the alert is a genuine attack or a false positive and assigns severity before escalation or containment. Acting on unverified SIEM data risks wasted effort or disrupting legitimate activity, so initial triage must precede deeper investigation, containment, or notification.

Go deeper

Related to this question