When selecting containment actions under limited resources, which factors should guide the sequence?

• A. The age of the systems involved.
• B. The color of the SOC dashboard.
• C. Randomly selecting actions to reduce bias.
• D. Impact to critical assets, likelihood and severity, potential data exposure, and containment options that minimize disruption.

Answer: (D)

Prioritizing containment actions when resources are scarce hinges on a risk-based approach that focuses on protecting what matters most to the organization. Start with impact to critical assets: identify which systems, services, and data are essential for operations and for regulatory or contractual obligations, and direct containment efforts toward those first. Next, weigh likelihood and severity: if a threat is likely and could cause major harm, it should take precedence because the potential risk is higher. Consider potential data exposure: if there’s a real chance of sensitive or regulated data leaking or being exfiltrated, containment must move quickly to limit that exposure. Finally, choose containment options that minimize disruption: prefer actions that stop the incident from spreading while preserving as much normal business function as possible, avoiding broad outages or unnecessary downtime.

The other options don’t fit because the age of systems doesn’t reliably indicate risk or the best containment sequence, the color of the SOC dashboard is irrelevant to decision-making, and randomly selecting actions wastes scarce resources and can increase risk.