ISC2 CISSP Practice Question

The most effective and immediate priority in an incident involving actively spreading malware is containment. This involves isolating affected systems to stop the malware from propagating further, which is a prerequisite for effective eradication and recovery. While gathering information (analysis), detecting the initial source, and communicating with stakeholders are all vital components of the incident response process, they follow or support the primary goal of limiting the immediate damage. Attempting to recover services before the incident is contained is often futile, as systems can become reinfected, and the scope of the incident can continue to grow.