CompTIA CySA+ CS0-003 Practice Question

The primary focus during the containment phase is to limit the spread of the infection to prevent further damage. This often involves isolating affected systems from the network to stop the malware from communicating with other systems. While identifying the root cause and developing a recovery plan are crucial steps in the incident response process, they typically occur after containment to understand the full extent of the threat and restore services effectively.