試験SY0-701-JPN トピック1 問題217 スレッド

Containment is the phase where an organization attempts to minimize the damage caused by a security incident. This may involve isolating affected systems, blocking malicious traffic, or temporarily shutting down compromised services to prevent further impact.
Recovery (A) focuses on restoring normal operations after an incident.
Preparation (C) involves planning and readiness before an incident occurs.
Analysis (D) involves investigating the root cause and assessing the damage.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Security Operations domain.