SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Identify the breach, then Isolate affected systems, then Investigate the scope and impact, then Contain the threat, then Remediate

  Why this is correct

  This sequence accurately reflects best practices in incident response, beginning with the crucial step of identifying the breach to confirm its existence and nature. Immediately following, isolating affected systems is paramount to prevent the spread of compromise and limit further damage. A thorough investigation then determines the full scope and impact, informing precise containment strategies to stop the attack. Finally, remediation removes the threat and restores systems to a secure, operational state, ensuring comprehensive recovery.

• ✗

  Identify the breach, then Investigate the scope and impact, then Contain the threat, then Isolate affected systems, then Remediate

  Why it's wrong here

  This order is incorrect because investigation should occur after isolation to avoid spreading the breach, and containment must happen before or alongside isolation, but here isolation comes after containment, delaying the critical step of separating affected systems.

• ✗

  Contain the threat, then Identify the breach, then Investigate the scope and impact, then Isolate affected systems, then Remediate

  Why it's wrong here

  Initiating containment before identifying a breach is fundamentally flawed, as effective containment requires knowledge of what is being contained; you cannot stop an unknown event. Furthermore, placing the critical step of isolating affected systems after both investigation and containment significantly delays damage control. Isolation should occur much earlier, typically right after identification, to prevent the threat from spreading further while detailed investigation and comprehensive containment strategies are developed and executed.

• ✗

  Identify the breach, then Isolate affected systems, then Remediate, then Investigate the scope and impact, then Contain the threat

  Why it's wrong here

  This order is wrong because remediation (removing the threat) should come after investigation and containment. Investigating after remediation misses the opportunity to understand the full impact, and containing after remediation is too late to prevent further spread.

Go deeper

Related to this question