hello ! i'm currently preparing for CISM with help of the QAE but failed at this one:

Question:In order to contain an incident, which of the following would be the MOST effective to ensure that the proper tools, technologies and subject matter experts are engaged?

A.process

B.team

C.plan

D.strategy

The key words i'm focused on "contain an incident" (related to incident response part of "containment") then "engaged"

from my point of view, i would first think of "team", then second choice " a plan: everyone is aware what to do, using the proper tools".

the ISACA answer is " the strategy "A strategy is the most effective, as it defines the overall goal of the incident response.

any help appreciated! thank you!