CRISC Practice Question: Order the steps for incident response handling.

Order the steps for incident response handling.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Step 1: Preparation, Step 2: Detection, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting

Incident response follows preparation, detection, containment/eradication/recovery, lessons learned, and reporting.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Step 1: Preparation, Step 2: Detection, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting
Why this is correct
This is the correct order because incident response starts with preparation to establish policies and resources, then detection identifies incidents, followed by containment/eradication/recovery to mitigate impact, lessons learned to improve future response, and reporting to document and communicate findings.
✗
Step 1: Detection, Step 2: Preparation, Step 3: Containment/Eradication/Recovery, Step 4: Lessons Learned, Step 5: Reporting
Why it's wrong here
This is incorrect because detection cannot occur without prior preparation (e.g., tools, policies, trained personnel). Preparation must be the first step.
✗
Step 1: Reporting, Step 2: Preparation, Step 3: Detection, Step 4: Containment/Eradication/Recovery, Step 5: Lessons Learned
Why it's wrong here
This is incorrect because reporting typically occurs after containment and lessons learned, not as the first step. Preparation must precede detection and response.
✗
Step 1: Preparation, Step 2: Containment/Eradication/Recovery, Step 3: Detection, Step 4: Lessons Learned, Step 5: Reporting
Why it's wrong here
This is incorrect because containment/eradication/recovery cannot be performed before the incident is detected. Detection must precede containment.

Go deeper