In the NIST incident response lifecycle, what phase follows Detection & Analysis?

• A. Recovery
• B. Post-Incident Activity
• C. Containment
• D. Eradication

Answer: (C)

In incident response, the next step after Detection & Analysis is containment. This phase focuses on stopping the attacker from doing more harm and limiting the incident’s spread while you figure out the scope. Practically, containment means isolating affected systems, blocking attacker commands, applying temporary fixes, and preserving evidence so you can investigate later. The goal is to keep the business running as smoothly as possible while you prevent further damage.

After containment, the next steps move toward eradication (removing the attacker’s access and artifacts), followed by recovery (restoring systems and services to normal operations), and finally post-incident activity (lessons learned and improvements). If you’re thinking about why the others don’t fit here: eradication would come after containment, recovery after eradication, and post-incident activity after recovery.