SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Notify senior management of the incident.

  Why it's wrong here

  Notification is a communication and escalation activity that occurs throughout the incident response lifecycle, but it is not a containment action. Containment is specifically about taking technical or operational measures to stop the adversary from continuing their malicious activities, such as blocking, isolating, or disabling access. Informing senior management keeps stakeholders aware but does not alter the attacker's ability to move laterally, persist, or exfiltrate data.

• ✓

  Block known malicious IP addresses at the firewall.

  Why this is correct

  Blocking known malicious IP addresses at the firewall is a direct and immediate containment action that severs the network communication path between the compromised environment and the attacker's command-and-control (C2) infrastructure. By applying egress and ingress rules to deny traffic to these IPs, you cut off remote commands, data exfiltration, and potential malware downloads, thereby limiting the adversary's operational control without disrupting normal business traffic.

• ✓

  Disable compromised user accounts.

  Why this is correct

  Disabling compromised user accounts is an effective containment measure that immediately revokes the legitimate authentication credentials the attacker has been using. This action prevents the adversary from authenticating to email, VPN, domain resources, or any other service, effectively evicting them from their current session and stopping further unauthorized actions, such as privilege escalation or accessing sensitive data, under that identity.

• ✓

  Isolate affected systems from the network.

  Why this is correct

  Isolating affected systems from the network is a classic containment step that physically or logically removes a compromised host from the rest of the environment, for example by disabling its network interface, applying a VLAN ACL, or using an EDR containment feature. This halts lateral movement, prevents the spread of malware, and stops outbound malicious traffic, while still preserving the system state for later forensic analysis without letting the attacker continue to operate.

• ✗

  Collect forensic data from affected systems.

  Why it's wrong here

  Collecting forensic data is an investigative and evidence-preservation activity, not a containment action, because taking memory images, copying disk volumes, or capturing logs does not stop an active threat. In fact, focusing on collection before containment can allow the attacker to continue moving laterally or exfiltrating data while you are gathering artifacts. Containment should be performed first to halt the attack; forensic collection then occurs in a controlled, post-containment state to preserve evidence accurately.

Go deeper

Related to this question