ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The primary goal during the containment phase of incident response is to stop an infection from spreading while preserving business operations. Detaching the suspected EC2 instance from the load balancer prevents new user traffic from reaching it, and tightening its security group to block all outbound traffic cuts off the worm's communication channel. The rest of the fleet continues serving customers, so availability is maintained. Immediately terminating the entire Auto Scaling group would disrupt service, applying patches does not stop the active outbreak, and simply enabling additional detection does not halt the malicious traffic.