Business Continuity, Disaster Recovery, and Incident Response →mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
A security analyst detects unusual outbound network traffic from a server that typically only handles internal file sharing. The traffic appears to be exfiltrating sensitive data. Which phase of the incident response process should the analyst initiate next?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analysis
After detection (phase 2), the next step is analysis to confirm the incident and understand its scope before containment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Containment
Why it's wrong here
Containment comes after analysis; immediate containment without analysis could disrupt operations unnecessarily.
- ✓
Analysis
Why this is correct
Analysis is the third phase, following detection, to investigate the alert and confirm it is a real incident.
- ✗
Lessons learned
Why it's wrong here
Lessons learned is the final phase after recovery.
- ✗
Eradication
Why it's wrong here
Eradication occurs after containment and analysis.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.