CompTIA Security+ (SY0-701) — Question 580

Which of the following phases of the incident response process attempts to minimize disruption?

Answer options

• A. Recovery
• B. Containment
• C. Preparation
• D. Analysis

Correct answer: B

Explanation

The Containment phase is focused on limiting the impact of an incident and preventing further damage, thereby minimizing disruption. Recovery aims to restore systems, Preparation involves planning ahead of incidents, and Analysis is for understanding what happened after an incident has occurred.