In incident handling, what is the difference between containment and eradication?

Prepare for the Trusted Agent Exam with engaging questions, flashcards, and detailed explanations. Dive deep into essential topics to increase your chances of success. Ace your exam with confidence!

Multiple Choice

In incident handling, what is the difference between containment and eradication?

In incident handling, containment is about stopping the damage by limiting how far the incident can spread and reducing its impact. This often means actions like isolating affected systems, blocking attacker movement, or segmenting networks so others aren’t drawn into the problem. Eradication, on the other hand, is about removing the threat itself and the root cause that allowed it to happen. This includes removing malware, closing exploited weaknesses, patching vulnerabilities, and revoking or changing breached credentials so the attacker can’t come back. So the best description aligns with containment limiting spread and impact, while eradication removes the underlying vulnerability or adversary. The other statements mix up these roles: containment isn’t simply removing a vulnerability, eradication isn’t just about fixing issues, and they aren’t the same thing.

In incident handling, containment is about stopping the damage by limiting how far the incident can spread and reducing its impact. This often means actions like isolating affected systems, blocking attacker movement, or segmenting networks so others aren’t drawn into the problem.

Eradication, on the other hand, is about removing the threat itself and the root cause that allowed it to happen. This includes removing malware, closing exploited weaknesses, patching vulnerabilities, and revoking or changing breached credentials so the attacker can’t come back.

So the best description aligns with containment limiting spread and impact, while eradication removes the underlying vulnerability or adversary. The other statements mix up these roles: containment isn’t simply removing a vulnerability, eradication isn’t just about fixing issues, and they aren’t the same thing.

More practice questions