ExpertMedium1 markMultiple Choice
CPA · Question 59 · Area II: Security
An auditor is reviewing the 'Incident Response Plan'. Which phase should occur immediately after 'Containment'?
An auditor is reviewing the 'Incident Response Plan'. Which phase should occur immediately after 'Containment'?
Answer options:
A.
Preparation
B.
Identification
C.
Eradication
D.
Recovery
How to approach this question
Memorize the PICERL cycle (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned).
Full Answer
C.Eradication✓ Correct
Eradication
Once the threat is contained (stopped from spreading), the root cause must be eradicated (removed) before recovery can begin.
Common mistakes
Skipping to Recovery before Eradication.
Practice the full CPA ISC Practice Exam 2
82 questions · hints · full answers · grading
More questions from this exam
Q01A service organization provides a cloud-based payroll platform where clients access the software ...MediumQ02An auditor is reviewing the backup strategy for a financial institution that requires a Recovery ...HardQ03During a walkthrough of the change management process, an auditor observes that developers have w...MediumQ04An auditor is reviewing a SQL query used to generate a list of active customers for a marketing c...HardQ05Which of the following entities is considered a 'Covered Entity' under the HIPAA Privacy Rule?Medium