ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

In the containment phase, the goal is to limit the incident's scope and prevent additional damage while preserving evidence for later analysis. Cutting off the exploited microservice's outbound communication and revoking its compromised credentials immediately stops further data loss yet keeps the system available for forensic capture. Applying patches or redeploying code addresses eradication-removing the root cause of the breach. Restoring from backups and returning the service to normal operations are recovery tasks. Producing a lessons-learned or post-incident report belongs to the post-incident activity phase, not containment.