ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

During the containment phase, the goal is to limit the attacker's ability to cause additional harm while preserving evidence for later analysis and eradication. The quickest way to contain a compromised EC2 instance is to isolate it from the rest of the environment-detaching it from the load balancer and Auto Scaling group and applying a tightly restricted security group prevents further inbound or outbound communication yet keeps the instance running so memory and disk evidence remain intact. Terminating and redeploying systems is a recovery action, not containment. Generating reports or updating documentation are post-incident activities. Enabling AWS Backup improves preparation and recovery capabilities but does not immediately stop the active threat.