In the incident response workflow, what step follows detection of an anomaly?

• A. Contain the model
• B. Investigate root cause
• C. Assess impact
• D. Verify results

Answer: (C)

After detecting an anomaly, the first priority is to assess impact. This means quickly evaluating how broad the issue is, which systems and data are affected, the potential business disruption, and any regulatory or risk implications. Understanding the scope and severity helps you prioritize actions, allocate resources wisely, and decide how urgent the response should be. Once you know the impact, you can determine whether containment needs to be accelerated, what to monitor, and who to involve.

Containment comes next to stop the spread and limit damage, using the information gathered about impact to guide which components to isolate or restrict. Investigating root cause is typically done after containment to uncover underlying factors that allowed the anomaly to occur and to prevent recurrence. Verifying results is part of the post-incident phase, confirming that the remedy worked and that systems are back to a secure state.