It has been reported to you that someone has caused an information spillage on their computer. You go to the computer, disconnect it from the network, remove the keyboard and mouse, and power it…

Discovery (Detection and Analysis) refers to the phase where the incident is first identified and analyzed, not where physical isolation actions are taken.

Recovery is the phase where affected systems are restored to normal operation after the threat has been removed, which occurs after containment and eradication.

Containment is the incident response phase in which responders take immediate action to limit the scope and impact of an incident, such as isolating the affected system by removing network access and shutting it down. According to NIST SP 800-61, containment strategies are applied after an incident is identified to prevent further damage or data loss before eradication and recovery begin. The actions described - network disconnection, peripheral removal, and power-down - are classic short-term containment techniques.

Eradication involves removing the root cause of the incident such as deleting malware or patching vulnerabilities, which has not yet occurred in this scenario.