Malware is confirmed on several workstations in a city's billing VLAN. The IR team immediately isolates that VLAN from the rest of the network. Which IR phase does this action represent?

Containment is the phase that stops an active incident from expanding while responders prepare durable cleanup. Isolating the city’s billing VLAN from the rest of the municipal network is a classic network containment control: it reduces lateral movement toward finance servers, domain controllers, and other departments without claiming that every malicious binary is already gone. Containment can be short-term (emergency VLAN quarantine, blocking C2) or longer-term (segmented rebuild zones) and should be chosen to balance business impact against spread risk. Isolation buys time for imaging, analysis, and planned eradication rather than letting malware continue to encrypt or exfiltrate.

Eradication is the removal of malware, persistence, and attacker footholds—not merely cutting a network path. A VLAN can be isolated while infected disks still hold backdoors; therefore isolation alone does not equal eradication. Recovery is the restoration of trustworthy business services and user access after cleanup validation; isolation typically reduces availability for billing users, so it is not recovery. Lessons learned is the post-incident improvement cycle and does not describe the tactical act of severing network connectivity. Exam caveats: do not confuse containment with eradication when the stem describes isolation, blocking, or segmentation during an active outbreak. Operationally, after isolating a billing VLAN, document what was cut, verify monitoring still covers the quarantine zone, preserve evidence, and only then schedule eradication and a controlled return path for payment processing once hosts are verified clean.