Containment (C)is thefirst critical stepduring a security incident tostop the spreadof the attack. This could include isolating affected systems, disabling accounts, or blocking malicious traffic.
According to theIncident Response Lifecycle, the order is typically:Identification → Containment → Eradication → Recovery → Lessons Learned.
[Reference: CompTIA Security+ SY0-701 Objectives, Domain 5.4 – “Incident response process: Containment as the immediate action.”, , , , ]
Submit