ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
During an incident, a security analyst detects unusual network traffic from a workstation that is exfiltrating data to an external IP address. The analyst isolates the workstation. Which incident response phase does the isolation action belong to?
⚠ Common exam trap
Test-takers frequently confuse Containment with Eradication — candidates see 'isolate the workstation' and think of removing the threat, but isolation only limits spread; removal of the root cause is Eradication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Containment
Isolation of an affected workstation is a containment action because it stops the spread of the incident and prevents further data exfiltration while the investigation continues. Containment is the phase in the NIST/SANS incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident) where the goal is to limit damage and prevent the incident from expanding. Detection and analysis involve identifying and validating the event; eradication removes the root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detection
Why it's wrong here
Detection covers identifying and validating the anomalous traffic, which the analyst already completed before isolating the host. Isolation is a containment action that limits spread while investigation continues. Detection would be the correct phase for recognising the exfiltration signature in logs or alerts, prior to any response action.
- ✗
Analysis
Why it's wrong here
Analysis interprets collected evidence to determine scope, impact, and root cause; it does not alter the host's network state. Isolation is containment, executed to stop data loss while analysis proceeds. Analysis would be the correct phase for examining the workstation's memory, logs, or artefacts to understand the intrusion.
- ✓
Containment
Why this is correct
Containment limits the scope and spread of an incident once detected. Isolating the workstation stops further data exfiltration to the external IP address and prevents lateral movement, while preserving evidence for the later eradication and recovery phases.
- ✗
Eradication
Why it's wrong here
Eradication removes the threat — deleting malware, patching the vulnerability, or rebuilding the host — and occurs after containment. Isolating the workstation merely stops ongoing exfiltration; the threat remains present. Eradication would be correct once the analyst has identified the root cause and is ready to eliminate it from the environment.
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Isolation
Isolation is the process of separating a compromised or suspicious system from a network to prevent the spread of malware or unauthorized access.
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.