Which statement best describes defensive actions in incident response?

Which statement best describes defensive actions in incident response?

• A. They focus on preventing further releases.
• B. They focus on maximizing releases.
• C. They require no prior risk assessment.
• D. They are always temporary.

Answer: (A)

Defensive actions in incident response are about stopping the attacker and reducing damage by preventing more data from leaking or more systems from being compromised. The goal is containment and protection: isolating affected systems, blocking attacker paths, applying patches, revoking compromised credentials, and other steps that cut off the ongoing impact. That focus on preventing further releases is exactly what defense aims for—keep the incident from getting worse. The other ideas don’t fit this aim. Trying to maximize releases would increase harm rather than contain it. Defensive actions are guided by risk considerations, not taken without assessment. And while some defensive steps are temporary (to stop the attack quickly), others become permanent fixes (like patches or network redesigns) to prevent recurrence.

Defensive actions in incident response are about stopping the attacker and reducing damage by preventing more data from leaking or more systems from being compromised. The goal is containment and protection: isolating affected systems, blocking attacker paths, applying patches, revoking compromised credentials, and other steps that cut off the ongoing impact. That focus on preventing further releases is exactly what defense aims for—keep the incident from getting worse.

The other ideas don’t fit this aim. Trying to maximize releases would increase harm rather than contain it. Defensive actions are guided by risk considerations, not taken without assessment. And while some defensive steps are temporary (to stop the attack quickly), others become permanent fixes (like patches or network redesigns) to prevent recurrence.