Which component of an effective incident response plan is primarily responsible for stopping the incident from spreading to other systems?

• A. Detection
• B. Analysis
• C. Containment
• D. Recovery

Answer: (C)

Stopping the incident from spreading hinges on containment. Once you identify an incident, the priority is to limit its reach so it can’t move to additional systems. Containment involves actions like isolating affected machines, severing or restricting network connections, applying segmentation rules, and blocking compromised credentials. These steps create a smaller, manageable footprint—the blast radius—so you can investigate, eradicate the threat, and eventually recover without the attacker widening their foothold. Detection tells you something is wrong, and analysis helps you understand scope and impact, but containment is what physically prevents further spread and buys time for the rest of the response.