Which of the following best describes the goal of containment during an incident?

• A. Limiting spread of the incident and preserving evidence
• B. Eradicating all artifacts immediately
• C. Replacing affected hardware
• D. Disabling all user accounts

Answer: (A)

Containment aims to stop the incident from spreading while preserving evidence for investigation. In practice, this means isolating affected systems, blocking suspicious traffic, and segmenting networks to prevent lateral movement, all done in a way that keeps logs, memory captures, and other forensic data intact. The goal is to reduce damage quickly without destroying data that will help understand how the incident occurred and how to prevent recurrence.

Choosing a path that tries to eradicate all artifacts immediately can destroy valuable evidence and hinder later analysis. Replacing affected hardware is a recovery action, not containment. Disabling all user accounts is disruptive and not a containment objective; it may be necessary in some scenarios, but it’s not about stopping spread or preserving evidence.