Which component is primarily responsible for isolating affected systems to prevent the spread of an incident?

Which component is primarily responsible for isolating affected systems to prevent the spread of an incident?

• A. Detection
• B. Recovery
• C. Containment
• D. Eradication

Answer: (C)

Containment is the component focused on isolating affected systems to prevent the incident from spreading. By temporarily disconnecting compromised devices, blocking certain network paths, or segmenting parts of the network, containment limits lateral movement and buys time to assess scope and implement a fix. Detection identifies that something is wrong but doesn’t stop spread on its own. Eradication removes the root cause after containment to eliminate the threat, and recovery restores services once containment and eradication are complete.

Containment is the component focused on isolating affected systems to prevent the incident from spreading. By temporarily disconnecting compromised devices, blocking certain network paths, or segmenting parts of the network, containment limits lateral movement and buys time to assess scope and implement a fix. Detection identifies that something is wrong but doesn’t stop spread on its own. Eradication removes the root cause after containment to eliminate the threat, and recovery restores services once containment and eradication are complete.