In incident response, what best describes containment?

• A. Stops the spread by isolating infected hosts
• B. Removes the root cause and artifacts
• C. Restores systems to normal operation
• D. Collects evidence for forensics

Answer: (A)

Containment is about stopping the spread of the incident by isolating infected hosts or segments of the network so the threat cannot move laterally and cause more damage. When responders detect a breach or malware, they quickly isolate affected systems, apply network controls, or segment networks to contain the impact while they assess scope and plan further actions. This step prioritizes limiting harm and buys time to pursue eradication (removing the root cause and artifacts), recovery (restoring systems to normal operation), and forensics (collecting evidence for investigation and future prevention).