What is the primary goal of containment in incident response?

• A. To prevent spread of incident while maintaining business operations
• B. To immediately restore all systems
• C. To collect all data
• D. To notify customers

Answer: (A)

Containment aims to stop the incident from spreading while keeping essential operations running. The idea is to quickly isolate affected systems and block the attacker’s movement so you can study and fix the issue without causing a broader outage. It’s about stabilizing the situation and preventing further damage, not about fully restoring everything immediately or gathering all evidence at once. Restoration and forensic data collection come after containment, and notifying customers is part of communications and risk management, not the containment effort itself. So the best choice is the one that emphasizes preventing spread while maintaining operations.