ISC2 Governance, Risk and Compliance (CGRC) Practice Question

NIST SP 800-61 recommends that once an incident is confirmed, the handler's first priority in the containment phase is to limit further damage as quickly as possible while also preserving evidence for later analysis. Isolating the compromised host from the network stops additional data loss and, if done properly, still allows responders to capture volatile memory before shutting the system down for forensics. Wiping or re-imaging the server is an eradication step that destroys evidence; delaying action to await external notification risks continued data loss; and continuing to allow exfiltration for evidence collection conflicts with the objective of rapid containment.