CCSP Containment Practice Question
During a cloud security incident, a security team needs to isolate a compromised virtual machine instance that is performing outbound port scanning. Which containment action should be taken first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the security group to deny outbound traffic
Modifying the virtual machine's security group rules to deny all outbound traffic is a quick and reversible containment action that stops the scanning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terminate the virtual machine instance immediately
Why it's wrong here
Terminating the instance destroys data and may be irreversible; not the best first step.
- ✓
Modify the security group to deny outbound traffic
Why this is correct
Modifying the security group rules quickly stops outbound scanning while preserving the instance for further investigation.
- ✗
Create a snapshot or image of the virtual machine for analysis
Why it's wrong here
Creating an image is useful for forensics but does not immediately contain the threat.
- ✗
Detach the virtual machine from the virtual network
Why it's wrong here
Detaching from the network may disrupt connectivity but is not as quick or reversible as modifying security group rules.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.