Containment and verification steps in incident response serve what purpose?

• A. Containment is optional
• B. Verification is not needed after containment
• C. Containment limits impact and verification confirms resolution
• D. Containment delays resolution

Answer: (C)

The main idea is that containment and verification work together to minimize the damage from an incident and ensure it is fully resolved. Containment focuses on stopping the incident from spreading by isolating affected systems, blocking attack paths, and preventing further impact. This buys time to eradicate the threat without letting it affect more parts of the environment.

Verification then checks that the containment was successful and that the threat has been eliminated. It confirms that residual malware or unauthorized access has been removed, systems are clean, patches and hardening are in place, and normal operations can safely resume. Without verification, you might think the problem is resolved when hidden indicators could still exist.

So, containment limits impact, and verification confirms that the resolution is complete and safe.