ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
During an incident, a security analyst detects unusual network traffic from a workstation that is exfiltrating data to an external IP address. The analyst isolates the workstation. Which incident response phase does the isolation action belong to?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Containment
Containment is the phase where actions are taken to stop the incident from spreading or causing further damage, such as isolating affected systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Detection
Why it's wrong here
Detection involves identifying the incident, not taking action to stop it.
- ✗
Analysis
Why it's wrong here
Analysis focuses on understanding the scope and impact, not immediate containment.
- ✓
Containment
Why this is correct
Isolation is a containment strategy to prevent further damage.
- ✗
Eradication
Why it's wrong here
Eradication involves removing the root cause, which comes after containment.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
Key term
Isolation
Isolation is the process of separating a compromised or suspicious system from a network to prevent the spread of malware or unauthorized access.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.