easyMultiple Select
CISM Practice Question: Which TWO of the following are primary goals of…
Which TWO of the following are primary goals of the containment phase in incident response? (Select TWO)
⚠ Common exam trap
CISM often tests phase boundaries, and the trap is selecting eradication or recovery activities (root cause removal, restoring operations) as containment goals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Prevent the incident from spreading to other systems
Option D is correct because the containment phase is specifically designed to stop an active incident from propagating to additional hosts, accounts, or network segments, for example by isolating compromised endpoints, segmenting VLANs, or blocking malicious C2 traffic at the firewall. Option E is correct because containment also aims to limit the scope and impact of the incident, minimizing damage to data, services, and other assets while the incident is still being actively managed. Options A, B, and C do not belong here: restoring normal business operations is the goal of the recovery phase, eradicating the root cause is the goal of the eradication phase, and while evidence preservation is important throughout incident response, it is not one of the two primary goals of containment itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restore normal business operations
Why it's wrong here
Restoration is part of the recovery phase.
- ✗
Eradicate the root cause of the incident
Why it's wrong here
Eradication is a separate phase after containment.
- ✗
Preserve evidence for legal proceedings
Why it's wrong here
Evidence preservation occurs throughout, but not a primary containment goal.
- ✓
Prevent the incident from spreading to other systems
Why this is correct
Containment isolates affected systems to halt lateral movement, directly satisfying the goal of preventing spread to other systems. Segmenting networks, disabling accounts, or blocking traffic stops the adversary propagating while evidence is preserved for later eradication and recovery phases.
- ✓
Limit the scope and impact of the incident
Why this is correct
Containment bounds the damage by limiting how many assets, data sets, or services the incident touches, satisfying the scope-and-impact goal. This differs from eradication, which removes the threat; containment focuses on stopping further harm while investigation continues.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.