ISC2 Certified in Cybersecurity (CC) Practice Question

The containment phase focuses on limiting the immediate impact of an incident by preventing additional damage or spread. Disconnecting or isolating compromised hosts, blocking malicious traffic, or disabling affected accounts helps stop the attacker's progress while preserving evidence for later analysis. Identifying baseline traffic is part of detection and analysis, hardening systems is associated with eradication or recovery, and documenting lessons learned occurs in the post-incident activity phase.