200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Containment Eradication and Recovery, Detection and Analysis, Preparation, Post-Incident Activity

  Why it's wrong here

  Containment, Eradication and Recovery cannot precede Preparation and Detection, because you cannot contain an incident before preparing for it and detecting it. The order is tempting as responders often think first about stopping the damage, but NIST SP 800-61 Rev 2 begins with Preparation, then Detection and Analysis, then Containment, Eradication and Recovery, and Post-Incident Activity last.

• ✗

  Post-Incident Activity, Preparation, Detection and Analysis, Containment Eradication and Recovery

  Why it's wrong here

  Post-Incident Activity cannot come first, as lessons learned and evidence retention only follow a completed response cycle. It is tempting because reviewing outcomes feels like a sensible starting discipline, yet NIST SP 800-61 Rev 2 orders the phases Preparation, Detection and Analysis, Containment Eradication and Recovery, then Post-Incident Activity.

• ✓

  Preparation, Detection and Analysis, Containment Eradication and Recovery, Post-Incident Activity

  Why this is correct

  NIST SP 800-61 Rev 2 orders the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication and Recovery; then Post-Incident Activity. This sequence reflects the standard's four-phase structure, with lessons learned occurring only after recovery completes.

• ✗

  Detection and Analysis, Preparation, Containment Eradication and Recovery, Post-Incident Activity

  Why it's wrong here

  Detection and Analysis cannot precede Preparation, since preparation establishes the capability, tools and team before any detection occurs. The sequence is tempting because detection feels like the natural starting point of an investigation, yet NIST places Preparation first, then Detection and Analysis, Containment, Eradication and Recovery, and finally Post-Incident Activity.

Go deeper

Related to this question