What does 'dwell time' refer to in incident response?

• A. Time from containment to eradication
• B. Time to perform malware analysis
• C. Time from initial access to detection and containment
• D. Time to prepare legal hold

Answer: (C)

Dwell time is the period an attacker remains inside a network from the moment they first gain access until they are detected and contained. The best choice captures this full window: it starts at initial access and ends with detection and containment, reflecting how long the adversary was active before defenses stopped them. This metric is key for understanding detection effectiveness and incident response speed.

Why the other ideas don’t fit: measuring the time from containment to eradication focuses on remediation steps after containment, not the attacker’s presence. The time to perform malware analysis is a specific investigative task, not the overall intrusion duration. The time to prepare a legal hold relates to compliance and legal processes, not incident presence in the environment.