8.2.3. Containment

Try these first

1. 1.

   What is the primary purpose of containment in incident response?

   Hint

   Think about how to prevent further damage.

2. 2.

   Name one action taken during short-term containment.

   Hint

   What would you do immediately when an incident is detected?

3. 3.

   What is the main goal of containment in incident response?

   • To eliminate the threat
   • To limit the damage
   • To restore systems

   Hint

   Focus on the impact containment has during an incident.

4. 4.

   True or False: Long-term containment can involve bringing affected systems back online without any updates.

   • True
   • False

   Hint

   Consider the security needs before restoring services.

5. 5.

   Design a protocol for short-term containment in a case where multiple systems across an organization are showing signs of compromise.

   Hint

   Consider every step carefully to minimize impact during the containment.

6. 6.

   Evaluate the potential consequences of failure to implement proper containment after an incident is detected.

   Hint

   Reflect on how a lack of containment can snowball effects.