It has been reported to you that someone has caused an information spillage on their computer. You go to the computer, disconnect it from the network, remove the keyboard and mouse, and power it…

Discovery is the phase where the incident is first identified or reported, which had already occurred before these actions were taken.

Recovery involves restoring systems to normal operation after the threat has been removed, not isolating the affected machine.

Containment is the incident handling phase where responders isolate the affected system to prevent further damage or spread. Disconnecting from the network removes lateral movement risk, while powering down stops active processes - both actions limit scope without yet addressing the root cause or restoring service.

Eradication is the phase where the root cause (malware, unauthorized account, etc.) is actively removed from the environment.