350-201 Question 166
Select 3An organization is implementing a new incident response (IR) process and wants to align it with Cisco's Cybersecurity Incident Response framework. During the containment phase of an incident, which of the following actions should be performed to ensure minimal impact to the business while securing the environment?
- A
Isolate affected systems from the network to prevent further spread of the incident.
- B
Identify and document the root cause of the incident before initiating containment actions.
- C
Apply temporary fixes, such as blocking malicious IPs or disabling compromised accounts.
- D
Notify all employees of the incident and instruct them to immediately power down their systems.
- E
Preserve evidence, including system logs and memory snapshots, for further analysis.
Show answer and explanation
Correct answers: A, C, E
Explanation
The containment phase of an incident response process focuses on minimizing the immediate impact of the incident while securing the environment. Actions like isolating affected systems, applying temporary fixes, and preserving evidence are aligned with Cisco's Cybersecurity Incident Response framework. Root cause analysis and employee-wide notifications are handled in other phases of the IR process.
- A. Correct.
Isolating affected systems is a critical containment step to prevent further damage or propagation of the incident.
- B. Incorrect.
Identifying and documenting the root cause is part of the eradication and recovery phases, not containment, as containment focuses on minimizing immediate impact.
- C. Correct.
Applying temporary fixes, such as blocking malicious IPs or disabling accounts, helps mitigate the threat while the incident is being addressed.
- D. Incorrect.
Notifying all employees and powering down systems could disrupt business operations unnecessarily and may result in loss of critical evidence.
- E. Correct.
Preserving evidence is essential during containment to ensure the incident can be properly analyzed and addressed during the investigation phase.