During incident containment, which step should occur first?

• A. Quickly Isolate Affected Systems To Prevent Spread
• B. Revoke Compromised Credentials
• C. Notify Stakeholders
• D. Restore From Backups

Answer: (A)

The priority in containment is to stop the attacker from causing more harm by cutting off their ability to spread. Quickly isolating affected systems from the network prevents lateral movement and data exfiltration, which reduces the incident’s impact and protects the rest of the environment while you gather information and plan next steps. Once containment is in place, you would then revoke compromised credentials, notify stakeholders, and later restore from trusted backups after you’ve cleaned and verified the environment. Isolating systems first is essential because it directly halts the rapid propagation of the attack, buying time for effective eradication and recovery.