ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
During an incident, the incident response team identifies that a malware infection is spreading. They isolate affected systems to prevent further damage. Which phase of the incident response process are they performing?
⚠ Common exam trap
Watch out — candidates often confuse containment with eradication; candidates often think that isolating systems is part of removing the malware, but containment is specifically about stopping the spread, not eliminating the threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Containment
Containment is the incident response phase focused on limiting the scope and impact of an incident by stopping the spread of malware and preventing further damage. Isolating affected systems directly aligns with this goal, as it prevents lateral movement and additional infections. This phase occurs after detection and before eradication and recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recovery
Why it's wrong here
Recovery restores systems to normal operation after the threat is removed. Isolating affected systems to halt malware spread is containment. Recovery would be correct if the team were returning cleaned systems to production, validating backups or monitoring for reinfection following eradication.
- ✗
Eradication
Why it's wrong here
Eradication removes the malware itself, such as deleting files or rebuilding hosts, after containment. Isolating systems limits spread, which is containment. Eradication would be correct if the team were eliminating the infection from already-contained systems rather than stopping its propagation.
- ✗
Detection
Why it's wrong here
Detection identifies that an incident is occurring; it precedes containment actions such as isolating systems. The team has already detected the spreading malware and is now limiting its scope. Detection would be correct if the question described monitoring, alerting or analysing indicators to discover the infection.
- ✓
Containment
Why this is correct
Isolating infected systems halts malware propagation, which is the defining activity of the containment phase. Containment limits incident scope before eradication and recovery begin, directly satisfying the stem's goal of preventing further damage across the network.
Go deeper
Related to this question
Learn chapter
Business Continuity and Disaster Recovery
Key term
Eradication
Eradication is the phase in incident response where the root cause of a security breach is completely removed from the system to prevent the attack from happening again.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.