Which NIST response stage focuses on isolating affected systems to prevent an incident from spreading?
Answer
Containment
Explanation
### Why this is right
Containment limits spread by isolating affected systems or restricting functions.
### The concept
Containment is distinct from eradication: it limits ongoing harm, while eradication removes the root cause.
### The other options
- **A. Preparation**: establishes capability before incidents.
- **C. Recovery**: restores and validates systems after remediation.
- **D. Post-incident activity**: reviews lessons and updates response materials.
### Remember
Contain first to limit spread; eradicate to remove the cause.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free