Containment Strategies Quiz

What you'll be asked

1. What is the primary goal of the containment phase in incident response?
2. Which of the following is an example of a short-term containment strategy?
3. You detect a malware infection spreading via internal network shares. Which containment action is most appropriate to balance business continuity and security?
4. When dealing with a persistent threat, why might an incident responder choose to implement 'sandboxing' rather than immediately shutting down a system?
5. In a scenario involving a sophisticated APT (Advanced Persistent Threat), you decide to employ 'deception' as a containment strategy. How does this achieve containment?

Answers and explanations come after you submit.