Explain different containment strategies for security incidents. How do you balance the need for rapid containment against the risk of alerting attackers or disrupting business operations?

Sample answer preview

Containment strategies aim to prevent an incident from causing additional damage while preserving evidence and maintaining business operations where possible. The optimal approach depends on incident characteristics, organizational priorities, and available resources.