ISC2 Certified Cloud Security Professional (CCSP) Practice Question

In the containment phase, responders act quickly to limit the attacker's ability to continue or expand the intrusion, but without destroying or altering evidence that investigators will later need. Adding a high-priority deny rule in the cloud network security group that blocks the single malicious IP meets this goal: it immediately stops further brute-force traffic yet keeps the bastion host and cluster online so analysts can capture volatile memory and disk images. Simply increasing SIEM log retention is a detection/analysis enhancement, not a containment control, and it will not halt the active attack. Filing a breach notification may be required by regulation, but it belongs to the communication phase and does not mitigate the live threat. Shutting down and deleting the entire virtual network is an eradication/recovery action that causes needless downtime and eliminates evidence.