SSCP Incident Response and Recovery Practice Question
A security analyst receives a user report about a workstation exhibiting unusual behavior, such as unexpected pop-ups and slow performance. The analyst first checks the antivirus logs and finds no alerts. What is the NEXT step in the detection and analysis phase?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Classify the severity of the potential incident
According to incident response best practices, after initial detection, the next step is to classify the severity of the potential incident to prioritize response efforts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate the incident to senior management
Why it's wrong here
Escalation may occur later, but first the incident must be analyzed and classified.
- ✗
Isolate the workstation from the network immediately
Why it's wrong here
Isolation is part of containment, which occurs after the incident is confirmed and classified.
- ✗
Perform a forensic memory capture
Why it's wrong here
Forensic imaging is done after containment and during investigation.
- ✓
Classify the severity of the potential incident
Why this is correct
Severity classification helps determine the appropriate response priority.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.