CCOA Incident Detection And Response Practice Question
An incident response team is performing containment on a compromised Linux server that is part of a containerized environment. Given that the container is running in a Kubernetes cluster, which action is the most appropriate initial containment step to preserve the volatile memory for forensics while preventing further data exfiltration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pause the container process using container runtime tools
Pausing the container allows for the preservation of current memory states, whereas deletion or isolation via network policies might trigger cleanup scripts or lose memory artifacts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pause the container process using container runtime tools
Why this is correct
Pausing the container halts execution while keeping the container in a state where memory can be dumped for forensic analysis.
- ✗
Remove the container image from the registry
Why it's wrong here
This is a global action that affects all nodes and does not contain the running instance on the specific compromised host.
- ✗
Update the Kubernetes NetworkPolicy to deny all ingress and egress
Why it's wrong here
While this prevents communication, it does not stop the malicious process from running or modifying memory within the host.
- ✗
Delete the pod immediately to stop the communication
Why it's wrong here
Deleting the pod destroys the ephemeral storage and volatile memory, losing critical forensic evidence.
About these practice questions
Courseiva writes every CCOA question from scratch — 203 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official ISACA exam blueprint
This CCOA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCOA exam.