Which of the following steps of incident handling and response process focus on limiting the scope and extent of an incident?

The Containment phase of the incident response lifecycle is explicitly focused on limiting the scope and extent of an incident. Once an incident has been identified and analyzed, the primary goal of containment is to prevent it from spreading to other systems and to stop further damage. This is achieved through actions such as isolating compromised hosts from the network, disabling breached user accounts, or blocking traffic from malicious IP addresses. These short-term measures stabilize the environment, allowing for a controlled eradication and recovery process.

B. Data Collection: This is a continuous process that supports all phases, especially Identification and Analysis, but its primary goal is not to limit the incident's scope.
C. Eradication: This phase focuses on removing the root cause of the incident (e.g., malware, vulnerability) after it has been successfully contained.
D. Identification: This is the initial phase of detecting and verifying that a security incident has occurred, which precedes any action to limit its scope.

1. Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology. Section 3.2.3, "Containment," pp. 23-25, states, "Containment is important before an incident overwhelms resources or increases damage."