hardMultiple ChoiceObjective-mapped

CISM Practice Question: An incident response team is dealing with a…

An incident response team is dealing with a persistent threat that uses fileless malware. Which containment strategy is most effective?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Isolate affected endpoints from the network while preserving memory

Isolating affected endpoints preserves volatile memory evidence needed to analyze fileless malware.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Isolate affected endpoints from the network while preserving memory
Why this is correct
Correct: Contains the threat and preserves forensic data.
✗
Disable user accounts
Why it's wrong here
Disabling accounts does not contain the malware if it's running in memory.
✗
Block known malicious IPs
Why it's wrong here
Blocking IPs may not address the local execution of fileless malware.
✗
Reimage all endpoints
Why it's wrong here
Reimaging destroys evidence and does not allow analysis of the malware.

Go deeper