easyMultiple ChoiceObjective-mapped
CISSP A company experiences a data breach Practice Question
A company experiences a data breach. Which step should be taken first according to best practices?
⚠ Common exam trap
Many exam-takers confuse the urgency of notification (A) or assessment (D) with the immediate need to stop the attack, forgetting that containment is the foundational step that enables all subsequent actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contain the breach
According to incident response best practices (NIST SP 800-61), the first priority after confirming a breach is to contain it. This prevents further data exfiltration, limits lateral movement by an attacker, and preserves forensic evidence. Containment actions may include isolating affected systems, blocking malicious IPs at the firewall, or revoking compromised credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inform affected parties
Why it's wrong here
While crucial for transparency and regulatory compliance, informing affected parties prematurely, before the full scope and impact of the breach are understood, can lead to misinformation and unnecessary panic. This step is typically performed after containment, eradication, and a thorough assessment of the incident, allowing for accurate and actionable communication as mandated by various data protection laws.
- ✓
Contain the breach
Why this is correct
Containment is the immediate and most critical first step in incident response following identification. Its primary objective is to stop the incident from spreading further, limit the damage, and prevent additional data loss or system compromise. This involves isolating affected systems, disabling compromised accounts, and implementing temporary fixes to stabilize the environment.
- ✗
Notify law enforcement
Why it's wrong here
Notifying law enforcement is an important step, especially for criminal activity or significant breaches, but it is not the immediate first action. Organizations should first focus on containing the breach and conducting an initial assessment to gather pertinent information and evidence. Providing law enforcement with a clearer picture of the incident's scope and nature facilitates a more effective investigation.
- ✗
Assess the damage
Why it's wrong here
While damage assessment is an integral part of understanding a breach, it is an ongoing process that begins *during* containment rather than being the absolute first step. The immediate priority is to halt the active threat and prevent further harm. A comprehensive assessment of the full extent of the damage can only be accurately performed once the incident is under control and the environment is stabilized.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.