In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?
A) Identification
B) Preparation
C) Lessons learned
D) Eradication
E) Recovery
F) Containment

Question

Quizplus · Accepted Answer

The security engineer is in the Containment phase, which involves isolating affected systems to prevent further damage and spread of the attack.

In the Middle of a Cyberattack, a Security Engineer Removes