ISC2 CC Business Continuity, DR & Incident Response Practice Question
Exhibit
Refer to the exhibit. --- Incident #1023 - Malware Infection Detection: Antivirus alert on workstation WKS-045 Time: 2024-03-15 14:22 UTC Actions: 14:25 - Isolated WKS-045 from network 14:30 - Scanned system, detected Trojan.Downloader 14:35 - Escalated to incident handler 14:45 - Removed malware via AV 15:00 - System back online ---
Based on the incident log, at which step did the incident response team contain the threat?
⚠ Common exam trap
ISC2 often tests the distinction between containment and eradication, where candidates mistakenly choose removal (Option B) as containment, but containment must stop the spread before any cleanup occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
14:25 - Isolated WKS-045 from network
Containment is the immediate step to prevent the threat from spreading, and isolating WKS-045 from the network at 14:25 achieves this by cutting off its network connectivity. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery. The log shows isolation occurred before scanning or removal, making it the correct containment action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
14:30 - Scanned system, detected Trojan.Downloader
Why it's wrong here
Scanning is part of identification/analysis, not containment.
- ✗
14:45 - Removed malware via AV
Why it's wrong here
Removal is eradication, which follows containment.
- ✓
14:25 - Isolated WKS-045 from network
Why this is correct
Isolation prevents further spread, containing the threat.
- ✗
14:35 - Escalated to incident handler
Why it's wrong here
Escalation is communication, not containment.
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Eradication
Eradication is the phase in incident response where the root cause of a security breach is completely removed from the system to prevent the attack from happening again.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.