CompTIA CySA+ CS0-003 Practice Question

In any incident response, the immediate priority is to contain the breach to prevent further damage. Identifying affected systems is a crucial first step as it allows the incident response team to isolate those systems, thereby containing the incident. Communication with stakeholders and external parties is also important but comes after containment as it does not help mitigate the ongoing damage. Recovery and remediation usually follow these initial steps and focus on restoring affected systems and fixing vulnerabilities.