What is the primary goal of containment?

• A. To restore normal operations.
• B. To collect more data.
• C. To degrade the capabilities of an adversary, denying them the opportunity to achieve their goals.
• D. To punish attackers.

Answer: (C)

Containment is about stopping the attacker from progressing and reducing the damage by degrading their ability to achieve their objectives. In practice, this means actions like isolating affected systems, blocking malicious traffic and command-and-control channels, revoking or restricting compromised credentials, and segmenting networks to prevent spread. The aim is to reduce risk and buy time for investigation and remediation, not to restore operations immediately or to collect data as the primary goal, and certainly not to punish attackers. By limiting attacker capabilities and opportunities, containment effectively curtails the incident’s impact while you determine the full scope and proceed with recovery.