Which of the following is an outcome of the initial triage during incident response?

The initial triage phase of incident response is designed to quickly assess an event, determine its severity, and take immediate action to limit the impact. A primary outcome of this process is containment. Segmenting the network to isolate compromised systems from critical assets is a fundamental containment strategy. This action directly prevents the lateral movement of an attacker and stops the incident from escalating, which is the core goal of the triage and initial containment steps in the incident response lifecycle.

A. Removal of unnecessary accounts is an eradication activity, which occurs after the incident has been contained and thoroughly investigated.
C. Resetting registry keys is a specific remediation action performed during the recovery phase, long after initial triage and containment.
D. Determining the use of encryption is part of the initial analysis or identification phase that informs triage decisions, rather than being an outcome of it.

1. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide": Section 3.3, "Containment, Eradication, & Recovery," outlines the incident response lifecycle. Section 3.3.1, "Containment Strategy," discusses that containment actions are based on the initial analysis (triage) of the incident. It states, "Containment is important before an incident overwhelms resources or increases damage... It provides time for developing a tailored remediation strategy." Network segmentation is a key example of such a strategy.

2. Carnegie Mellon University, Software Engineering Institute, "Defining Incident Management Processes for CSIRTs" (CMU/SEI-2018-TR-003): This report details the incident management lifecycle. In Section 4.2, "Triage," the process is described as analyzing data to prioritize handling. The immediate follow-on step, "Respond," involves containment. The document emphasizes that containment actions, such as "disconnecting a host or network segment from the network," are taken based on the triage assessment to prevent further damage.

3. SANS Institute, "The Incident Handler's Handbook" (a foundational text for GIAC certifications): The widely taught PICERL (Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned) model places Containment immediately after Identification (which includes triage). The handbook details that a primary goal of containment is to "prevent the attackers from accessing more of your systems," with network segmentation being a primary technique to achieve this. (Reference: SANS SEC504 courseware principles).