Which activity is part of an incident response plan?

Which activity is part of an incident response plan?

• A. Installing new hardware without testing.
• B. Ignoring suspicious activity.
• C. Investigating and assessing security incidents to determine impact and containment.
• D. Decommissioning user accounts arbitrarily.

Answer: (C)

The main idea is that an incident response plan hinges on quickly understanding what happened, how it affects systems and data, and what needs to be contained. Investigating and assessing security incidents lets responders determine the scope and severity, identify affected assets, and decide the appropriate containment actions to stop further damage. This step also guides recovery and future prevention, making it a core part of the plan. Actions like installing new hardware without testing, ignoring suspicious activity, or arbitrarily decommissioning user accounts do not follow a structured, controlled response approach and can create new risks, miss evidence, or disrupt operations.

The main idea is that an incident response plan hinges on quickly understanding what happened, how it affects systems and data, and what needs to be contained. Investigating and assessing security incidents lets responders determine the scope and severity, identify affected assets, and decide the appropriate containment actions to stop further damage. This step also guides recovery and future prevention, making it a core part of the plan. Actions like installing new hardware without testing, ignoring suspicious activity, or arbitrarily decommissioning user accounts do not follow a structured, controlled response approach and can create new risks, miss evidence, or disrupt operations.