Study ISC2 CISSP Incident Response: key concepts, common traps, and exam decision cues.
On this page
Operations questions often reward order and discipline more than aggression. CISSP wants you to recognize when evidence must be preserved, when containment is appropriate, and how investigations remain defensible.
Response-choice map
Requirement
Better first instinct
preserve facts for legal or internal investigation
proper evidence handling and chain of custody
limit immediate harm from active malicious activity
containment
understand what happened and how
structured investigation with reliable data sources
handle volatile digital evidence responsibly
follow order-of-volatility logic where relevant
What the exam is really testing
If the stem says…
Strong reading
“possible prosecution”
evidence integrity and documentation matter immediately
“active incident”
contain without destroying more information than necessary
“forensics”
reproducibility and defensible handling matter more than speed alone
Decision order that usually wins
Decide whether the primary need is containment, preservation, investigation, or recovery.
If legal or disciplinary action is possible, prioritize evidence integrity immediately.
Preserve volatile and high-value evidence before taking destructive action.
Contain the incident in a way that limits harm without wrecking the investigation.
Keep accountability, documentation, and chain of custody intact throughout.
Operations questions often punish “act first, explain later” instincts. CISSP wants disciplined response that reduces harm while preserving the facts needed to understand and prove what happened.
Scenario triage
Scenario
Better first move
incident may end in court or formal HR action
preserve evidence and document chain of custody
attacker is still active
contain carefully while retaining needed evidence
system holds volatile memory evidence
follow order-of-volatility logic
team wants to wipe and rebuild immediately
check whether evidence must be preserved first
responders want shared crisis credentials
maintain individual accountability during response
Common traps
Trap
Better rule
reimaging a system before preserving needed evidence
once volatile evidence is gone, it is gone
sharing generic admin credentials during response
accountability still matters during a crisis
confusing eradication with first response in every scenario