(ISC)2 Certified in Cybersecurity Practice Exam

Which of the following is not a priority during incident response?

1. Assigning blame

2. Containing damage

3. Restoring normal operations

4. Documenting actions taken

The correct answer is: Assigning blame

During an incident response, the focus is primarily on effective management and resolution of the incident rather than on assigning blame. The objectives during an incident response process include containing the damage to minimize impacts, restoring normal operations to resume business continuity, and documenting actions taken to ensure there is a clear record of the incident and the response efforts for future reference and improvement of incident handling procedures. Assigning blame can lead to a negative atmosphere and discourage open communication, which is vital during a crisis. In contrast, an effective incident response emphasizes teamwork, learning from the event, and enhancing security measures to prevent future occurrences. By prioritizing practical steps that address the incident itself, organizations can better protect their assets, ensure safety, and improve their overall cybersecurity posture.