Courseiva
Incident Detection And ResponsemediumMultiple ChoiceObjective-mapped

CCOA Incident Detection And Response Practice Question

An incident response team is performing containment on a compromised Linux server that is part of a containerized environment. Given that the container is running in a Kubernetes cluster, which action is the most appropriate initial containment step to preserve the volatile memory for forensics while preventing further data exfiltration?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Pause the container process using container runtime tools

Pausing the container allows for the preservation of current memory states, whereas deletion or isolation via network policies might trigger cleanup scripts or lose memory artifacts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Pause the container process using container runtime tools

    Why this is correct

    Pausing the container halts execution while keeping the container in a state where memory can be dumped for forensic analysis.

  • Remove the container image from the registry

    Why it's wrong here

    This is a global action that affects all nodes and does not contain the running instance on the specific compromised host.

  • Update the Kubernetes NetworkPolicy to deny all ingress and egress

    Why it's wrong here

    While this prevents communication, it does not stop the malicious process from running or modifying memory within the host.

  • Delete the pod immediately to stop the communication

    Why it's wrong here

    Deleting the pod destroys the ephemeral storage and volatile memory, losing critical forensic evidence.

About these practice questions

Courseiva writes every CCOA question from scratch — 203 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official ISACA exam blueprint

This CCOA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCOA exam.