Which incident response phase focuses on stopping the spread and impact of an incident?

• A. Preparation
• B. Recovery
• C. Lessons Learned
• D. Containment

Answer: (D)

Stopping the spread and limiting the impact of an incident is the focus of containment in incident response. This phase aims to isolate affected systems, block attacker access, and prevent lateral movement so the incident doesn’t damage more assets or disrupt more operations. By containing the threat, defenders buy time to perform further steps without allowing it to escalate. After containment, teams typically move to eradication and recovery, but containment is specifically about halting the spread and reducing harm. Preparation is about getting ready before incidents occur, and lessons learned is about reviewing what happened afterward to improve future responses.