GSEC Incident Handling and Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Containment

  Why this is correct

  Containment aims to limit the scope and impact of an incident. Isolating the server prevents further lateral movement and stops the attacker from exfiltrating data or causing more damage. This is a classic containment action, as it separates the affected system from the rest of the network while allowing forensic analysis to continue.

• ✗

  Preparation

  Why it's wrong here

  Preparation involves establishing policies, tools, and training before an incident occurs. Isolating a compromised server is a reactive step taken during an active incident, not part of pre-incident readiness. Preparation would include having an isolation playbook ready, but the act of isolating is not preparation itself.

• ✗

  Recovery

  Why it's wrong here

  Recovery focuses on restoring normal operations, such as bringing the server back online after it has been cleaned and verified. Isolating the server is the opposite of recovery; it takes the system out of production to prevent further harm. Recovery would happen later in the incident lifecycle.

• ✗

  Eradication

  Why it's wrong here

  Eradication involves removing the threat, such as deleting malware or closing vulnerabilities. Isolation does not remove the attacker or the malware; it only restricts their ability to communicate. Eradication would occur after containment, when the analyst cleans the system or rebuilds it.