SSCP Incident Response and Recovery Practice Question
A security analyst receives a user report about a workstation exhibiting unusual behavior, such as unexpected pop-ups and slow performance. The analyst first checks the antivirus logs and finds no alerts. What is the NEXT step in the detection and analysis phase?
⚠ Common exam trap
The trap is jumping to containment (isolating the workstation) or escalation because those feel urgent; the exam tests whether you follow the correct sequence where severity classification precedes containment and escalation in the detection and analysis phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Classify the severity of the potential incident
In the detection and analysis phase of incident response, after initial validation and checking antivirus logs, the analyst must classify the severity of the potential incident to determine the appropriate response level and prioritization. Classification guides whether the incident warrants escalation, isolation, or deeper forensic investigation. This step aligns with NIST SP 800-61 and SSCP incident handling principles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate the incident to senior management
Why it's wrong here
Escalating to senior management is an incident-response communication step, not part of detection and analysis. It is tempting because management notification is required for major incidents, and it would be correct after analysis confirms severity and scope, but here the analyst has only an unverified user report and empty antivirus logs.
- ✗
Isolate the workstation from the network immediately
Why it's wrong here
Isolation is a containment action, which belongs to the containment, eradication and recovery phase, not detection and analysis. It is tempting because isolating a suspected compromised host limits lateral movement, and would be correct once analysis confirms malicious activity — but here the analyst must first gather further evidence, such as memory, network and endpoint telemetry.
- ✗
Perform a forensic memory capture
Why it's wrong here
Memory capture is a later, resource-intensive step, not the immediate next action after antivirus logs show nothing. It is tempting because volatile memory can reveal fileless malware that leaves no disk artefacts, but the detection and analysis phase first requires gathering further evidence such as EDR telemetry, running processes and network connections.
- ✓
Classify the severity of the potential incident
Why this is correct
With antivirus logs clear, the analyst must still triage the report; classifying severity determines whether it becomes a formal incident and drives escalation and resourcing, which is the next detection-and-analysis action before containment or eradication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.