In incident response, which stage focuses on stopping the spread of the incident?

In incident response, which stage focuses on stopping the spread of the incident?

• A. Containment
• B. Identification
• C. Recovery
• D. Eradication

Answer: (A)

Stopping the spread of an incident is addressed by containment. Containment focuses on limiting how far the incident can reach, so it doesn’t spread to additional systems or data. This often means isolating affected hosts, quarantining compromised network segments, and implementing temporary access controls to block attacker movement. By containing the incident, you prevent further damage and give teams time to analyze what happened, decide on eradication steps, and then recover. The other stages have different goals: identification is about discovering and understanding the incident and its scope, eradication is about removing the threat from the environment, and recovery is about restoring services to normal operation after the threat is neutralized.

Stopping the spread of an incident is addressed by containment. Containment focuses on limiting how far the incident can reach, so it doesn’t spread to additional systems or data. This often means isolating affected hosts, quarantining compromised network segments, and implementing temporary access controls to block attacker movement. By containing the incident, you prevent further damage and give teams time to analyze what happened, decide on eradication steps, and then recover. The other stages have different goals: identification is about discovering and understanding the incident and its scope, eradication is about removing the threat from the environment, and recovery is about restoring services to normal operation after the threat is neutralized.