Certificate of Cloud Security Knowledge (CCSK) — Question 205

Which action is part of the containment phase of the incident response lifecycle?

Answer options

• A. Evaluating infrastructure by proactive scanning and network monitoring, vulnerability assessments, and performing risk assessments
• B. Planning notification and coordination of activities
• C. Making considerations for data loss versus service availability
• D. Configuring and validating alerts
• E. Analyzing what happened

Correct answer: C

Explanation

Option C is correct as it directly relates to the decision-making process during the containment phase, where the focus is on balancing data loss against maintaining service availability. The other options pertain to different stages of incident response, such as preparation or analysis, rather than containment.