easyMultiple SelectObjective-mapped
CISM Practice Question: Which TWO of the following are primary goals of…
Which TWO of the following are primary goals of the containment phase in incident response? (Select TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Prevent the incident from spreading to other systems
The primary goals of the containment phase are to limit the scope and impact of the incident (E) and prevent it from spreading to other systems (D). These actions aim to stop further damage and isolate affected resources. Eradication (B) is a separate phase, preserving evidence (C) is important but not a primary containment goal, and restoring normal operations (A) belongs to the recovery phase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restore normal business operations
Why it's wrong here
Restoration is part of the recovery phase.
- ✗
Eradicate the root cause of the incident
Why it's wrong here
Eradication is a separate phase after containment.
- ✗
Preserve evidence for legal proceedings
Why it's wrong here
Evidence preservation occurs throughout, but not a primary containment goal.
- ✓
Prevent the incident from spreading to other systems
Why this is correct
Containment includes isolating affected systems to prevent spread.
- ✓
Limit the scope and impact of the incident
Why this is correct
Containment aims to stop the incident from causing more damage.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.