EC-Council CCT Lab – Incident Containment IH&R

🔬

Lab Environment — Scenario

Warren, a member of IH&R team at an organization, was tasked with handling a malware attack launched on one of servers connected to the organization's network. He immediately implemented appropriate measures to stop the infection from spreading to other organizational assets and to prevent further damage to the organization.

🛡

Incident Response Simulation

01Preparation

→

02Detection

→

03Triage

→

04Containment

→

05Eradication

→

06Recovery

incident-response.log

[14:22:03] ALERT — Malware detected on SRV-PROD-04

[14:22:15] IH&R — Warren assigned to incident #2847

[14:23:01] ACTION — Isolating SRV-PROD-04 from network

[14:23:08] ACTION — Blocking lateral movement on VLAN-12

[14:23:22] ACTION — Firewall rules updated — outbound C2 traffic blocked

[14:23:45] CONTAINED — Infection isolated — spread prevented

[14:24:00] STATUS — Containment measures active — no further propagation

🔒 Containment stops the threat from spreading while preserving evidence for analysis

❓

Identify the IH&R step performed by Warren in the above scenario.

A Containment

B Recovery

C Eradication

D Incident triage

📖

Mini Lesson — Containment in Incident Handling

01 — Definition

What is Containment?

Containment is the IH&R phase where responders take immediate action to isolate the affected systems and prevent the incident from spreading to other parts of the network or organization.

02 — How It Works

Process

The compromised system is isolated from the network (e.g., disconnecting it, blocking traffic via firewall rules, segmenting VLANs). Short-term containment stops immediate spread, while long-term containment keeps the system isolated during investigation.

03 — Why It Matters

Significance

Without containment, malware or attackers can move laterally across the network, compromising additional assets and causing exponentially greater damage. Quick containment limits the blast radius of an incident.

04 — Real-World Example

In Practice

A ransomware infection is detected on one server. The incident responder immediately disconnects the server from the network and blocks its VLAN to prevent the ransomware from encrypting files on other machines.

05 — Key Takeaway

Remember This

Containment = stop the spread. It comes after detection and triage but before eradication (removing the threat) and recovery (restoring systems). If the scenario says "prevent further damage" or "stop spreading," the answer is containment.

Incident Handling Containment

Lab Environment — Scenario

Incident Response Simulation

Identify the IH&R step performed by Warren in the above scenario.

Mini Lesson — Containment in Incident Handling