200-201 Security Policies and Procedures Practice Question

During the Containment, Eradication, and Recovery phase, which TWO actions are typically performed? (Select two.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Evidence collection

Short-term containment (e.g., isolating systems) and evidence collection are key activities in this phase.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Lessons learned analysis
Why it's wrong here
This occurs in Post-Incident Activity.
✓
Evidence collection
Why this is correct
Collecting forensic evidence before eradication.
✗
Initial triage
Why it's wrong here
Initial triage is part of Detection and Analysis.
✗
Identifying the incident
Why it's wrong here
Identification is part of Detection and Analysis.
✓
Short-term containment
Why this is correct
Immediate actions to stop the incident from spreading.

Go deeper