Name a typical stage in an incident response lifecycle.

Name a typical stage in an incident response lifecycle.

• A. Eradication
• B. Containment
• C. Recovery
• D. Preparation

Answer: (B)

Containment is a typical stage in the incident response lifecycle because, once an incident is detected, the immediate priority is to stop the spread and minimize damage. Containment actions aim to isolate affected systems, block attacker access, and segment networks so the threat cannot move laterally or exfiltrate data. This pause in activity buys time for investigation and planning, helping preserve evidence and prevent further impact while the team works out the full scope of the breach. After containment, efforts shift to eradication (removing the threat and artifacts) and recovery (bringing systems back online and verifying they’re clean), with preparation (planning and preventative controls) happening beforehand to reduce future incidents.

Containment is a typical stage in the incident response lifecycle because, once an incident is detected, the immediate priority is to stop the spread and minimize damage. Containment actions aim to isolate affected systems, block attacker access, and segment networks so the threat cannot move laterally or exfiltrate data. This pause in activity buys time for investigation and planning, helping preserve evidence and prevent further impact while the team works out the full scope of the breach. After containment, efforts shift to eradication (removing the threat and artifacts) and recovery (bringing systems back online and verifying they’re clean), with preparation (planning and preventative controls) happening beforehand to reduce future incidents.