Defensive Security (Blue Team) / Response and recovery
Lesson 26 of 32
Containment
Containment stops an incident spreading: isolate infected machines, disable stolen accounts, block bad IPs. Do it quickly, but keep evidence.
Key points
- Isolate, don't just switch off
- Reset compromised credentials
- Keep evidence for investigation
Quiz · +10 XP
A laptop is infected. What's a good containment step?
Log in to save progress and earn XP.