ISC2 CC Business Continuity, DR & Incident Response Practice Question
Which TWO actions are appropriate during the identification phase of incident response?
⚠ Common exam trap
ISC2 often tests the distinction between identification and containment, so the trap here is that candidates mistake disconnecting systems (a containment step) for an identification action, when in fact identification must occur first to confirm the incident.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correlate alerts from multiple sources.
During the identification phase of incident response, the goal is to detect and confirm that an incident is occurring. Correlating alerts from multiple sources (e.g., IDS/IPS logs, firewall logs, and endpoint detection) helps reduce false positives and provides a clearer picture of the attack chain. Reviewing system logs for anomalies is a core detection technique that can reveal indicators of compromise (IoCs) such as unusual process execution or failed login bursts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a post-mortem analysis.
Why it's wrong here
Post-mortem occurs after incident resolution.
- ✓
Correlate alerts from multiple sources.
Why this is correct
Alert correlation aids in identifying incidents.
- ✓
Review system logs for anomalies.
Why this is correct
Log review helps identify potential incidents.
- ✗
Restore data from backups.
Why it's wrong here
Restoration is part of recovery phase.
- ✗
Disconnect affected systems from the network.
Why it's wrong here
This is a containment action, not identification.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Attack chain
The attack chain (or kill chain) is a model that describes the stages of a cyberattack, from initial reconnaissance to the final objective, helping defenders understand and disrupt each phase.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.