Which action best enforces containment by isolating a malware-infected host to prevent spread?

• A. Remove the compromised computer
• B. Update all software on the network
• C. Change the router password
• D. Back up all data

Answer: (A)

Containment in incident response is about isolating an infected system so it cannot communicate with other devices, slow or stop the malware’s spread, and give responders a chance to clean and restore systems.

Removing the compromised computer from the network achieves this most directly. By disconnecting it, the malware loses its means to propagate to other hosts, access other systems, or receive further commands, which stops the outbreak at its source and prevents new infections while you examine and remediate the machine.

Other options don’t isolate the infected host. Updating all software on the network is important for reducing vulnerabilities, but it doesn’t stop the current infected machine from spreading. Changing the router password affects access control but doesn’t remove the infected host from the network. Backing up data is about recovery and continuity and may even capture unclean data if the malware is still active; it doesn’t contain the spread.