Certificate of Cloud Security Knowledge (CCSK) — Question 80

The containment phase of the incident response lifecycle requires taking systems offline.

Answer options

• A. False
• B. True

Correct answer: B

Explanation

The correct answer is B because during the containment phase, it is essential to limit the spread of the incident by taking affected systems offline. Option A is incorrect as leaving systems online could exacerbate the incident and lead to further damage.