ISC2 Systems Security Certified Practitioner (SSCP)

Which action is part of the "containment" phase in incident response?

Disconnecting affected systems from the network Analyzing log data to identify the cause of the incident Reporting the incident to regulatory authorities Restoring affected systems from backups

Correct Answer:

Disconnecting affected systems from the network

Access more questions from this quiz

Continue to ISC2 Systems Security Certified Practitioner (SSCP) for more practice questions and the full quiz experience.

Access More Questions