Containment, Eradication, and Recovery Decisions

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Containment, Eradication, and Recovery Decisions

Key Takeaways Explain This Topic AI

Containment limits active harm; the method must fit business impact, safety, and evidence needs.

Short-term containment buys time fast; long-term containment keeps a system available behind stricter controls until root cause is removed.

Eradication removes malware, persistence, exploited vulnerabilities, exposed credentials, and unsafe configuration; blocking one indicator is not eradication.

Recovery must restore only from trusted sources (clean backup, gold image, infrastructure as code) and include validation that the incident does not recur.

Order of volatility says preserve volatile data (RAM, running processes, network connections) before powering off or reimaging.

Last updated: June 2026

Three Distinct Activities

Containment, eradication, and recovery are sequential and related, but they are not interchangeable, and SY0-701 will test whether you can tell them apart. Containment limits active harm. Eradication removes the cause and the attacker's foothold. Recovery restores trusted service. A strong IR answer picks the action that matches the current phase and the risk, not just the action that feels fastest.

Containment Choices and Tradeoffs

Situation Containment action Tradeoff

Malware beaconing from one laptop Network-isolate the host in EDR Fast and targeted, but may tip off the attacker

Compromised user account Disable account, revoke sessions, reset credentials Stops account use, but may interrupt legitimate work

Ransomware on a file server Block SMB, isolate server, disable suspect service account Limits spread, but breaks shared file access

Malicious IP scanning a web app Block source at the WAF or firewall Useful if source is fixed, weak if attacker rotates infrastructure

• Stolen cloud access key Disable the key, review recent API calls Stops key abuse, but apps using it may fail
• Short-term vs. long-term containment

Short-term containment is the immediate action: isolate the host, pull the cable, disable the account. Long-term containment stabilizes operations while you prepare a permanent fix, for example placing a still-needed but vulnerable server behind tighter segmentation and monitoring until a patched rebuild is ready. The exam expects you to recognize that a system sometimes must stay online under stricter controls rather than be torn down immediately.

Isolation, Segmentation, and Sandboxing

Security+ tests several specific containment techniques by name, and knowing the difference between them is worth a question or two. Isolation removes an affected asset from the network entirely so it can do no further harm and reach no further targets; EDR network containment that keeps the management channel alive while cutting everything else is a favorite modern method. Segmentation does not pull the asset offline but confines it to a restricted network zone, often a quarantine VLAN, limiting lateral movement while preserving needed connectivity.

Sandboxing detonates or runs suspicious code in a controlled, instrumented environment so analysts can observe behavior without risking production. A subtle exam trap is choosing full isolation when the scenario stresses that the system controls a safety-critical or revenue-critical process; in operational-technology and healthcare contexts, abruptly isolating a controller can cause physical or patient harm, so segmentation plus monitoring may be the safer, expected answer. Match the containment aggressiveness to the business and safety risk described.

Order of Volatility

Before you power off or reimage, capture evidence in order of volatility , most perishable first. Reaching for the power cord first is a classic wrong answer because it destroys exactly the data forensics needs.

• CPU registers and cache
• RAM (running processes, network connections, decryption keys)
• Temporary files and swap/pagefile
• Disk (data at rest)
• Remote logging and monitoring data
• Physical configuration and archival media
• Decision Timeline

Scenario: A manufacturer finds suspicious remote access to a production support server.

• Time Evidence Decision
• 14:02 VPN login from an unusual country using an engineer's account Raise severity, review identity logs
• 14:07 EDR shows a remote shell on the support server Declare incident, preserve active session detail
• 14:10 Server runs reporting, not machinery Isolate from the VPN path, keep internal reporting available
• 14:18 Same account opened the password vault Disable account, revoke sessions, rotate accessed secrets
• 15:05 Persistence found as a scheduled task Capture evidence, then remove the task
• 17:40 Clean rebuild ready Restore from a known-good image and monitor

This shows why IR is rarely one action. Pulling the power cord might stop activity but destroys volatile evidence and may cause an unnecessary outage. Leaving the system online preserves evidence but allows continued attacker activity. The incident commander makes a risk-based call with technical and business input.

Eradication Actions

Eradication addresses root cause and footholds: remove malware, delete unauthorized scheduled tasks and services, close vulnerable remote access, patch exploited software, disable rogue accounts, rotate exposed credentials, and remove malicious inbox rules or OAuth grants. Do not confuse blocking an indicator with eradication. Blocking one IP reduces traffic but leaves stolen credentials, persistence, and a vulnerable application intact.

Recovery Actions and Validation

Recovery must use trusted sources : a clean backup, a gold image, infrastructure-as-code redeployment, or a system returned only after verified remediation. Always validate before declaring service restored:

Confirm patches and configuration fixes are present.

Confirm malicious accounts, keys, tasks, and services are gone.

Confirm monitoring and logging are active on the restored asset.

Confirm business owners can perform required functions.

Watch for repeat indicators after service returns.

Common Traps

Reimaging a host before collecting the evidence needed to scope the incident.

Restoring from a backup that already contains the persistence mechanism.

Resetting a password but never revoking active sessions and tokens.

Blocking one domain while ignoring the compromised host that generated the traffic.

Returning a system to service with no recurrence monitoring.

Treating containment as proof the incident is over.