Which component focuses on stopping the incident from spreading to other systems?

• A. Detection
• B. Containment
• C. Analysis
• D. Recovery

Answer: (B)

Stopping an incident from spreading to other systems is containment. Containment aims to limit the blast radius by isolating affected devices, blocking attacker movement, and segmenting networks so the incident cannot reach additional machines. This pause gives responders time to investigate, preserve evidence, and implement fixes without letting the problem cascade.

Detection plays the role of recognizing that something is wrong and alerting the team; it’s about recognizing the incident, not preventing its spread. Analysis focuses on understanding what happened, the scope, and the impact, which informs containment and remediation. Recovery is about restoring operations after the incident is contained and cleaned up, rather than stopping the spread in real time.