During incident response, what is the PRIMARY purpose of the containment phase?
A CISSP practice question covering Domain 7: Security Operations. Try answering before reading the explanation below.
Show options & answer
Why "Limit additional damage and prevent the incident from spreading" is the right answer
Containment stops the bleed: isolating affected systems, blocking attacker IPs, disabling compromised accounts. Eradication removes the cause; recovery restores service. Investigating root cause spans detection/analysis and lessons learned. The phases are ordered intentionally.
Study videos for this topic
Want to go deeper on Domain 7? Watch the full breakdown — every video is free, no account, no upsell.
Take the full CISSP practice test
120 questions, instant explanations, study-video links on every miss. No account.