Explain why responders should secure and collect data during containment rather than focusing only on disconnecting systems.
Answer
Isolation can limit spread, but collected and secured data supports analysis, confirms incident scope, and informs eradication and recovery. Responders should consider evidence and documentation while selecting short-term and long-term containment measures.
Explanation
### What a good answer covers
- Containment limits the incident's spread and impact.
- Evidence and system data help determine what happened and which systems are affected.
- Findings guide eradication and recovery decisions.
- Short-term and long-term containment needs may differ.
### Remember
Containment must reduce harm while preserving information needed to understand the incident.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free