Malware is confirmed on several workstations in a city's billing VLAN. The IR team immediately isolates that VLAN from the rest of the network. Which IR phase does this action represent?
Select an answer to reveal the explanation.
Short Explanation
Containment is throwing a firebreak around the billing VLAN so the blaze cannot jump. Isolation stops lateral movement; it does not by itself yank every backdoor off the disks. Eradication is the cleanup pass, and recovery is when billing comes back clean.
Full Explanation
Containment limits the blast radius of an active incident—here by isolating the compromised billing VLAN—so attackers cannot pivot while responders plan cleanup. Eradication removes malware and persistence mechanisms; recovery restores operations from known-good state. Lessons learned occur after the incident to improve future response. Isolating a segment is a classic containment control, not eradication or recovery.