ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Short-term containment aims to limit the attacker's ability to continue malicious activity while preserving evidence for later analysis. Isolating the compromised system achieves this by cutting off any further interaction with the threat actor and preventing lateral movement, yet keeps the instance available for forensic imaging. Patching software or redeploying a clean AMI are eradication or long-term containment actions. Restoring from backups is part of the recovery phase, and issuing public notifications or holding lessons-learned meetings occurs during post-incident activities, not during initial containment.