Cyber Defense · lesson 11 of 12 · 12 min

Containment and recovery

summary: Containment limits harm while preserving evidence. Recovery restores trusted operations, verifies systems, and monitors for recurrence. Decisions should follow an approved response plan.

question: What is a goal of containment?

options:

• Limit further impact
• Erase all evidence
• Make every system public
• Skip verification

correct: Limit further impact

explanation: Containment reduces the spread or impact of an incident while investigation continues.

---

Previous lesson: Incident response lifecycle
Back to Cyber Defense
Next lesson: Post-incident review