Certified Incident Handler (CIH) Practice Ecam

Which action is taken first in an incident response process?

1. Containment

2. Identification

3. Eradication

4. Recovery

The correct answer is: Identification

In the incident response process, identifying the incident is the crucial first step. This stage involves recognizing and determining the nature of the incident to understand its impact on the organization. Proper identification ensures that the response team can prioritize actions effectively and formulate a response plan based on accurate information. It set the foundation for all subsequent steps, as it allows responders to analyze the situation comprehensively and choose appropriate containment, eradication, and recovery strategies. A swift and clear identification minimizes the risk of escalation and helps in efficiently mobilizing resources to address the threat.