Problem Statement
Why is containment an essential step in incident response?
Explanation
Containment prevents further spread of an attack or data loss. It may involve disconnecting compromised systems, disabling accounts, or blocking network traffic. The goal is to stop the harm quickly while preserving evidence for investigation.
