easyMultiple SelectObjective-mapped
SSCP Practice Question: A security operations team is developing an…
A security operations team is developing an incident response plan. Which TWO steps are part of the 'containment, eradication, and recovery' phase? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restoring systems from known good backups
Options B and E are correct. Isolating affected systems (E) is a containment action, and restoring systems from known good backups (B) is part of recovery. Option A (lessons learned) occurs after the incident. Option C (root cause) is part of identification and analysis, not containment/eradication/recovery. Option D (preserving forensic evidence) is important but typically done during identification and analysis, not as part of containment/eradication/recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conducting a lessons learned meeting
Why it's wrong here
This is part of the post-incident activity phase.
- ✓
Restoring systems from known good backups
Why this is correct
This is part of recovery after eradication.
- ✗
Identifying the root cause of the incident
Why it's wrong here
Root cause identification is part of analysis.
- ✗
Preserving forensic evidence
Why it's wrong here
Evidence preservation occurs during identification and containment.
- ✓
Isolating affected systems from the network
Why this is correct
This contains the incident to prevent spread.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.