Security+ incident response: contain, eradicate and recover
Preparation creates the people, plans, and tools for response. Detection and analysis determine what happened and how far it spread. Containment limits damage, eradication removes the cause and persistence, and recovery returns clean services to operation. Preserve useful evidence according to the situation and authority. A later review should improve the process rather than merely close the ticket.
How to read the scenario
Isolating a host may contain a threat without removing it. Restoring service before the cause is addressed can allow compromise to return.
Identify the required outcome, the evidence already provided, and the limits on the technician’s action. Compare every option against those details before deciding. Record why the closest alternative does not meet the stated need.
Original practice example
Before any incident, a company trains responders, assigns roles, and prepares approved tools. Which response phase is this?
- Containment
- Preparation
- Eradication
- Detection and analysis
Show the answer and explanation
Preparation
Preparation establishes the capabilities and plans needed for effective response.
Study questions
Which objective does this guide support?
SY0-701, objective 4.8. This independent guide supports original practice and does not replace the full official objectives.
What should I watch for in a scenario?
Isolating a host may contain a threat without removing it. Restoring service before the cause is addressed can allow compromise to return.
Source and version
CompTIA official SY0-701 objectives, objective 4.8. Verified November 5, 2026. This guide targets SY0-701. SY0-801 is expected around November 17, 2026 and is outside this edition.