During which phase of the incident response process are containment and eradication activities performed?

Question

Options

• APreparation
• BRecovery
• CContainment
• DDetection and analysis

• A
  3% (1)
• B
  3% (1)
• C
  89% (34)
• D
  5% (2)

Explanation

Containment (Option C) is the phase where both containment and eradication activities are performed. In the NIST incident response lifecycle, the "Containment, Eradication, and Recovery" phase is often grouped together, but containment is the named phase where teams isolate affected systems, remove malware or threat actors, and eliminate the root cause of the incident.

Why the distractors are wrong:

• Preparation (A) occurs before an incident and focuses on building tools, policies, and team readiness - not responding to an active threat.
• Recovery (B) comes after eradication, focusing on restoring systems to normal operations and monitoring for recurrence.
• Detection and Analysis (D) is where incidents are identified, triaged, and investigated - but no active response actions like containment have begun yet.

Memory Tip: Think of the acronym P-D-C-R (Prepare before, Detect the problem, Contain and clean it up, Recover and return). "Contain" clearly maps to the C phase, which naturally bundles eradication since you can't truly contain a threat without also eliminating it.

No community discussion yet for this question.