SSCP Incident Response and Recovery Practice Question
During the detection and analysis phase, an analyst classifies an incident as P1 (critical) because it involves a breach of sensitive customer data. What is the IMMEDIATE next step the analyst should take?
⚠ Common exam trap
The trap here is that candidates often jump to containment (Option D) as the immediate technical step, but the SSCP exam emphasizes that for critical incidents involving sensitive data, escalation to management and legal must occur first to ensure legal and regulatory compliance before any technical action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate the incident to the incident response manager and legal counsel
When an incident is classified as P1 (critical) due to a breach of sensitive customer data, the immediate next step is to escalate to the incident response manager and legal counsel. This ensures that legal obligations (e.g., breach notification laws, regulatory reporting) and organizational authority are engaged before any technical actions that could alter evidence or violate chain-of-custody requirements. The detection and analysis phase prioritizes notification of key stakeholders to coordinate a lawful and effective response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notify the affected customers of the data breach
Why it's wrong here
Notification is done after investigation and legal guidance, not immediately upon classification.
- ✗
Create a forensic image of the compromised server
Why it's wrong here
Forensic imaging is part of evidence collection, which occurs after containment and escalation.
- ✓
Escalate the incident to the incident response manager and legal counsel
Why this is correct
P1 incidents require immediate escalation to management and legal for breach notification requirements.
- ✗
Begin containment by isolating affected systems
Why it's wrong here
Containment comes after escalation and decision-making; initial triage and escalation are immediate.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.