The NIST Incident Response Step the Team Skipped: Containment

350-201 By islever Editorial Last updated

Apply the incident response workflow Determine the steps to investigate potential endpoint intrusion across a variety of platform types such as desktop, laptop, IoT, mobile devices Evaluate the security controls of an environment, diagnose gaps, and recommend improvement

Short answer

A Contain the malware by isolating or quarantining the infected hosts before eradication and recovery, as required by the NIST SP 800-61 incident handling life cycle.

Question

The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of
infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling
guide?
  1. Contain the malware Correct Answer
  2. Install IPS software
  3. Determine the escalation path
  4. Perform vulnerability assessment

Key Takeaways

You must map each narrated action to a NIST phase and notice that removing malware is eradication, not containment — containment (isolating hosts, blocking spread) must happen first.

This CISSP CyberOps 350-201 question tests the NIST SP 800-61 incident handling life cycle. Because the team jumped from detection straight to malware removal and recovery, the missed step is containment (A).

Common mistake: Choosing D, vulnerability assessment: it is a sensible post-incident hardening activity but is not a named step in the NIST incident handling guide, so it cannot be the missing phase.

Expert Analysis

The governing framework. NIST SP 800-61 (Computer Security Incident Handling Guide) defines a four-phase incident response life cycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Within the third phase, containment explicitly comes before eradication: the team limits damage and stops further spread (isolating hosts, blocking command-and-control traffic, applying firewall or IPS rules) before removing the malware and restoring systems.

Mapping the scenario. The team's actions map cleanly onto the phases except at one point. Being "notified of detected malware" and identifying infected hosts equals Detection and Analysis. "Removed the malware" equals Eradication. "Restored the functionality and data" equals Recovery. "Planned a company meeting to improve the incident handling capability" equals Post-Incident Activity / lessons learned. There is no step anywhere in the narrative where infected hosts were isolated, quarantined, segmented, or blocked from communicating — that is the Containment step, which must precede eradication.

Why the other options fail. Option D, vulnerability assessment, is a reasonable post-incident hardening activity, but it is not a named step in the NIST incident handling guide, so it cannot be "the missed step" the question asks about. Option B, installing IPS software, is a prevention/hardening tool recommendation, not a phase of the NIST life cycle. Option C, determining the escalation path, belongs to Preparation, and the prompt states the team was already "notified" of the detection, implying an escalation path functioned. Several comments correctly note that removing malware is eradication, not containment, and cite SP 800-61r2 for the containment-first requirement.

Verdict. Option A is correct: the missed step is containment — isolating or otherwise limiting the compromised hosts before eradication and recovery.

Official Reference

https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question lists a sequence of incident-handling actions, annotate each one with its NIST phase before reading the options. Any phase that appears only in your annotation but not in the narrative is the gap. Beware questions that offer plausible security activities (vulnerability scans, new tool installs) rather than actual life-cycle phases — the NIST taxonomy is what the question is testing.

Frequently Asked Questions

Why is removing malware not the same as containment in NIST SP 800-61?

Containment limits damage and stops the incident from spreading, such as isolating hosts or blocking C2 traffic. Removing the malware is eradication, a later sub-step that must not begin until containment is in place.

Where does a vulnerability assessment fit in the NIST incident handling life cycle?

It is not a formal phase. Hardening and gap remediation arise from post-incident activity (lessons learned) and ongoing vulnerability management, so it cannot be the 'missed step' in a NIST-based question.

What are examples of containment actions for a malware-infected host?

Network isolation or quarantine, disabling the host's network adapter, applying firewall rules to block command-and-control domains, and snapshotting the host for forensics before eradication.

More 350-201 FAQ →

Community Votes

A
60%
D
30%
C
10%

60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. CiscoTester 👍 3
    The fact that it says "IR team was notified" makes me think there has always been an escalation path. They removed the malware (eradicate) but did they fully contain it, could it happen again? I think its A.
  2. Medjai89 👍 2
    A, contain the malware https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf
  3. maxson69 👍 2
    Yep Contain step is missing here. Answer is A
  4. rhaphaexzzux 👍 2
    C. Determine the escalation path
  5. DrVoIP 👍 1
    D. Perform vulnerability assessment. After removing the malware and restoring the functionality and data of infected systems, the incident response team should perform a vulnerability assessment to identify the root cause of the incident and any other potential vulnerabilities that could lead to future incidents. This step is important to prevent future incidents and to improve the incident handling capability of the organization. Containment (A) is the initial step in the incident response process, and installing IPS software (B) can be a part of the containment or mitigation phase, depending on the specific incident. Determining the escalation path (C) is an important step in incident response, but it is not directly related to the handling of the current incident. Therefore, performing a vulnerability assessment (D) is the step that was missed in the incident response scenario according to the NIST incident handling guide. - ChatGPT
Show 6 more comments
  1. TrainingTeam 👍 1 Answered A
    According to the NIST incident handling guide, the steps for handling an incident include preparation, detection and analysis, containment, eradication, recovery, and post-incident activity12. In the scenario described, the incident response team has detected the malware, eradicated it by removing the malware, and recovered by restoring the functionality and data of infected systems. However, the step of containment, which should occur before eradication and recovery to prevent the spread of malware and further damage, appears to have been missed. Containment strategies are crucial to limit the scope and magnitude of an incident1.
  2. Luismi 👍 1 Answered A
    A. Contain the malware. Identifying infected hosts = Analysis; removing malware = Eradication, not Containment. NIST distinguishes between containment (isolating/blocking to prevent spread) and eradication (eliminating the malware or the cause of the compromise). The sequence jumps from identification directly to removal, followed by Recovery/Post-Incident. a public community thread option D does not align with the described phases.
  3. kyle942 👍 1 Answered C
    Containment was missed https://www.cynet.com/incident-response/nist-incident-response/
  4. TOLU1985 👍 1
    Why you select C then, while containment is related to A?
  5. TOLU1985 👍 1 Answered A
    Correct answer is A.
  6. TrainingTeam 👍 1 Answered A
    Correct answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Server Hardening Recommendations for Production Deployment

S-grade

Scoping a confirmed VPN intrusion: risk identification before containment

A-grade

← Back to 350-201 Study Guide