A threat actor has successfully attacked an organization and gained access to confidential files on a laptop. What plan should the organization initiate to contain the attack and prevent it from spreading to other network devices?

An incident response (IR) plan is the formal, documented set of procedures an organization initiates after a security breach has been identified. The primary goal of an IR plan is to manage the situation effectively to limit damage and reduce recovery time and costs. The scenario describes a successful attack that requires immediate action to "contain the attack and prevent it from spreading." This directly corresponds to the containment phase of the incident response lifecycle, which focuses on isolating affected systems to stop the threat from propagating further across the network.

A. root cause: Root cause analysis is a component of the post-incident phase, performed after containment to understand why the breach occurred, not the immediate plan to stop it.
B. intrusion prevention: This is a proactive security measure using systems (like an IPS) to block attacks before they are successful, not a reactive plan for an ongoing incident.
D. attack surface: This refers to the total number of potential entry points for a threat actor. Managing the attack surface is a preventative strategy, not a response plan.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2).

Section 3.3

"Containment

Eradication

& Recovery

" Page 23: "Containment is important before an incident overwhelms resources or increases damage. Most incidents require containment

so that is an important consideration early in the course of handling each incident." This directly supports the need for a plan to contain an active attack.

2. Cisco. (n.d.). What Is Incident Response?

"Incident response definition" section

Paragraph 1: "Incident response (IR) is the systematic approach that organizations take to prepare for

detect

contain

and recover from a cybersecurity breach." This official vendor definition explicitly includes containment as a core function of incident response.

3. Santos

O. (2020). CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide. Cisco Press.

Chapter 23

"Security Operations

" Section "Incident Response Plan

" Page 739: The text outlines the incident response process

stating

"The incident response plan should have a containment strategy to avoid further damage to other systems." This confirms that containment is a key part of the IR plan.