A threat actor has successfully attacked an organization and gained access to confidential files on a laptop. What plan should the organization…

Once an incident has occurred, the appropriate course of action is to engage the organization's

Incident Response (IR) plan. This is a structured approach to contain, analyze, and eradicate threats

before they spread across the network.

The Cisco CyberOps Associate study guide emphasizes:

“Incident response and handling are essential within an organization… The main objective of

implementing an incident handling process is to reduce the impact of a cyber-attack, ensure the

damages caused are assessed, and implement recovery procedures”.

In particular, the containment phase of IR is focused on isolating the threat and preventing lateral

movement or further compromise.

Options such as "root cause" or "attack surface" are relevant at later stages of analysis and

mitigation, not immediate containment. Therefore, the correct answer is C.