In a typical security incident workflow, which step directly follows detection?

• A. Containment
• B. Recovery
• C. Evidence Collection
• D. Root Cause Analysis

Answer: (A)

The main idea here is the order of actions in an incident response. After detection, the immediate priority is to contain the incident to prevent further damage and stop the attacker from spreading. Containment involves isolating affected systems, blocking attacker access, and limiting lateral movement so the situation doesn’t escalate while you react. This step is what buys time to investigate, preserve evidence, and begin recovery without letting the incident grow.

Evidence collection and root-cause analysis are important, but they come after containment. Evidence gathering is typically performed during and after containment to preserve volatile data and determine scope, while root-cause analysis identifies how the incident occurred and why, which are followed by eradication and recovery. Recovery itself happens after the threat is contained and mitigated. So the direct next step is containment.