Free ISACA CISM Actual Exam Questions - Question 6 Discussion

D imo, while categorization is part of triage, the main goal is to stop the threat from causing more damage ASAP. Without containment, even if you know what’s going on, the incident can escalate quickly. Coordination and mitigation come into play later, but containment is the immediate priority once you identify the threat.

Probably C here too. Triage is all about quickly figuring out what kind of incident you’re dealing with and how serious it is, so you can decide what to do next. Coordination (A) and containment (D) come after you know what you’re facing, and mitigation (B) is more of a long-term fix. So sorting and prioritizing events makes the most sense as the first step.

C imo, triage is about sorting and prioritizing incidents, not handling them directly. Containment (D) happens after we know what’s urgent, so it’s not the primary goal here.

C. It’s about quickly sorting events to prioritize response efforts properly.

I’m thinking option D might be tempting, but isn’t containment more of a follow-up step after triage? Triage should be about quickly figuring out what’s most urgent, so maybe C still fits best? What do you think?

Option C makes sense since the main goal is to sort events quickly, so responders know what to focus on first. It’s about organizing before acting.

C imo