What is incident containment and which strategies help achieve it?

• A. Eliminating all risk from the system.
• B. Limiting spread; network segmentation, isolating affected assets, and removing attacker footholds.
• C. Waiting for the attacker to leave before acting.
• D. Only logging events without taking action.

Answer: (B)

Containment focuses on stopping the attacker from spreading and limiting the damage after a breach is detected. The best approach uses concrete actions that immediately curb the attacker’s reach: network segmentation to restrict movement between parts of the environment, isolating affected assets so compromised systems can’t communicate with others, and removing attacker footholds by eradicating backdoors, compromised credentials, and malware. These steps reduce the blast radius and create a safer window to perform thorough eradication and recovery.

Others are not suitable because eliminating all risk right away isn’t realistic during an active incident, waiting for the attacker to leave is passive and allows further harm, and simply logging events without taking action fails to stop ongoing activity and containment.