easyMultiple ChoiceObjective-mapped

SSCP Suspects a security incident Practice Question

An organization suspects a security incident. Which initial step should the incident response team take?

⚠ Common exam trap

It's easy for candidates to confuse the urgency of containment with the priority of evidence preservation, often selecting 'Contain the incident' because it seems immediately necessary, but the SSCP emphasizes that evidence must be secured first to support legal and forensic processes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Protect evidence

The initial step in incident response is to protect evidence (Option B) because preserving forensic data ensures the integrity of logs, memory dumps, and disk images for later analysis. According to NIST SP 800-61, the first priority after detection is to secure volatile data (e.g., RAM, network connections) before it is lost, which is critical for determining the scope and root cause of the incident.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Contain the incident
Why it's wrong here
Containment should occur after evidence preservation.
✓
Protect evidence
Why this is correct
Preserving volatile evidence is the first priority to support forensic analysis.
✗
Identify the attacker
Why it's wrong here
Identification of the attacker is part of the investigation, not the initial step.
✗
Notify law enforcement
Why it's wrong here
Law enforcement notification typically occurs after initial containment and evidence collection.

Go deeper

SSCP Suspects a security incident Practice Question

Why each option matters

Option-by-option breakdown

Related to this question