CISA Practice Question: Order the steps for responding to a security…

Order the steps for responding to a security incident in the correct sequence.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Detection, then Containment, then Eradication/Recovery, then Review, then Improvement

Incident response follows: detection, containment, eradication/recovery, review, and improvement.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Detection, then Containment, then Eradication/Recovery, then Review, then Improvement
Why this is correct
This is the correct order because incident response logically starts with detecting the incident, then containing it to prevent further damage, followed by eradicating the cause and recovering systems, after which a review is conducted to learn from the incident, and finally improvements are implemented.
✗
Containment, then Detection, then Eradication/Recovery, then Review, then Improvement
Why it's wrong here
This is incorrect because containment cannot occur before detection; you must first detect an incident before you can contain it.
✗
Detection, then Eradication/Recovery, then Containment, then Review, then Improvement
Why it's wrong here
This is incorrect because eradication/recovery should come after containment to ensure the incident is contained before removing the root cause and restoring operations.
✗
Detection, then Containment, then Review, then Eradication/Recovery, then Improvement
Why it's wrong here
This is incorrect because review should occur after eradication/recovery to evaluate the full response, not before the recovery phase.

Go deeper