CISM Question 199

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  The BEST answer is A. Isolate the system. Here’s why: • First priority after a server attack is to contain the incident to prevent further damage, data loss, or spread to other systems. • B. Initiate incident response is important, but it follows containment. You can’t fully respond until the system is isolated. • C. Conduct a security audit and D. Review vulnerability assessment are post-incident or preventative activities, not immediate actions. 💡 Rule of thumb for CISA/incident questions: 1. Contain → 2. Eradicate → 3. Recover → 4. Review/Learn

• 1

  A. initiate the incident response plan

• Chose B2

  Isolation is part of IR.