Which is not a potential consideration when performing incident response for a large enterprise?

• A. Country the attack originated from
• B. Legal considerations
• C. Business impact
• D. Resource availability

Answer: (A)

The key idea is that incident response focuses on immediate actions to limit damage and restore operations, not on identifying where the attacker is based. In an enterprise IR, you prioritize containment, eradication, recovery, and coordinated communication, guided by what will minimize impact and what you can practically do with available resources. Legal considerations matter because you must preserve evidence properly and meet breach notification and data privacy rules. Business impact drives which systems to isolate first, what to restore first, and how to communicate with stakeholders. Resource availability determines what tools, personnel, and time you can devote to the response.

Tracing the attack to a specific country is more about attribution and informing external investigations or threat intelligence, not about the immediate steps you take to stop the incident and recover. It may be considered later for strategic reasons, but it doesn’t drive the core incident response workflow.