Future Business Leaders of America (FBLA) Cybersecurity Practice Test

Which step of the incident response procedure focuses on limiting damage from a security incident?

1. Preparation

2. Containment

3. Recovery

4. Identification

The correct answer is: Containment

The step that focuses on limiting damage from a security incident is containment. During the containment phase of incident response, the primary objective is to isolate the affected systems or networks to prevent further harm. This might involve disconnecting compromised devices from the network, closing vulnerable services, or applying temporary security measures to restrict the spread of the incident. Effective containment helps to minimize any data loss or operational disruption and allows the incident response team to manage the situation more effectively. After containment, the process may involve recovery and remediation efforts, but the immediate focus during containment is solely on preventing the incident from worsening. Preparation involves establishing protocols and training personnel ahead of time, while recovery entails restoring systems to normal operations after the incident is managed. Identification is about recognizing that an incident has occurred and understanding its nature. Each of these steps plays a role in the overall incident response strategy, but containment is distinctively focused on damage limitation.