Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
the question does not explicitly say the attack is ongoing. BUT in incident response, once an incident is verified, the organization’s immediate priority is to limit harm unless the question clearly says the incident is already contained.
Once a security incident has been verified, the primary objective is containment. This means stopping the attack or breach from spreading and causing additional harm. If you skip this step and move directly to notifications or investigations, the organization could suffer more damage, such as data loss, system compromise, or operational disruption.
If the incident is verified, and it is not an event. As an information, security manager, not in an operational or technical role, the correct answer would be B. This question is vague and doesn’t clarify your role. The first action to perform after an incident is verified, is to prevent further damage to the organization. But that is an operational and technical role. it is asking for the most important, Not the first thing to do. The most important thing a security manager would be doing for this incident is informing the key stakeholders.