Free Isaca Cybersecurity Audit Certificate Actual Exam Questions - Question 7 Discussion
B, because you need to secure the scene before making any changes.
B evidence must be preserved early to ensure integrity before cleanup starts.
C imo, eradication usually involves removing the threat, so by that time, evidence should already be secured to avoid tampering or loss. Gathering evidence during eradication might risk altering or destroying important data. Preservation is more about capturing the initial state, which logically happens right before or during containment when you’re trying to understand and limit the incident. Recovery and lessons learned come too late since they focus on restoring systems and reviewing the incident rather than collecting data.
Good point about containment. I’d add that evidence gathering can start as soon as the incident is confirmed, which often overlaps with containment activities, so B still seems like the best fit here.
B. Containment is the phase where you stabilize the situation, so it makes sense to collect and preserve evidence before anything is changed or wiped out. Later phases focus more on fixing things.
Option A doesn’t seem right since lessons learned is more about reviewing what happened, not collecting evidence. Evidence gathering needs to happen earlier to avoid contamination.
I think the best fit here is B. Containment feels like the moment you lock things down to prevent further damage, and that’s when you’d secure and start preserving evidence. Waiting until eradication or recovery could risk losing critical data since the environment might change or get cleaned up. So securing evidence during containment makes the most practical sense.
Makes sense to focus on containment (B) because you need to secure the scene before evidence gets messed up. Collecting evidence too late risks losing key info. So I'm with B on this one.
A imo, lessons learned includes reviewing and preserving evidence for future use. The actual collection might start earlier, but the formal preservation and documentation is part of lessons learned.
C/D? Eradication focuses on removing threats, but evidence should already be preserved before this phase.
B imo. Containment is when you stop the attack and secure the environment, which is the critical moment to gather and preserve evidence before it can be altered or lost. Options like eradication or recovery happen later and focus more on fixing the issue, not collecting proof. Lessons learned is obviously after everything’s done. So containment fits best here since you’d want to capture evidence right after detecting the incident but before cleaning up.
B