Certified Information Security Manager (CISM) — Question 1061

Predetermined containment methods to be used in a cybersecurity incident response should be based PRIMARILY on the:

Answer options

• A. capability of incident handlers.
• B. type of confirmed incident.
• C. predicted incident duration.
• D. number of impacted users.

Correct answer: B

Explanation

The correct answer is B, as the type of confirmed incident directly influences the containment strategy chosen. Each type of incident may require a different approach, while the other options, such as the capability of incident handlers or the number of impacted users, are secondary considerations in the response process.