Containment strategies in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding containment strategy types

Which of the following best describes a segmentation containment strategy in cybersecurity?

A Backing up data regularly to restore systems after an attack

B Completely shutting down all network connections to stop an attack immediately

C Using antivirus software to detect and remove malware from infected devices

D Separating network segments to limit the spread of an attack within different parts of the network

💡 Hint

Think about how dividing a network can help control where an attacker can go.

Segmentation containment involves dividing a network into smaller parts to prevent attackers from moving freely. This limits damage and helps isolate threats.

📋 Factual

intermediate

Key goal of containment strategies

What is the primary goal of containment strategies during a cybersecurity incident?

A To identify the attacker’s identity quickly

B To limit the damage and prevent the attack from spreading further

C To immediately restore all affected systems to normal operation

D To delete all data on infected devices

💡 Hint

Containment focuses on controlling the incident, not on recovery or identification.

The main purpose of containment is to stop the attack from causing more harm by limiting its reach.

🔍 Analysis

advanced

Choosing the right containment method

A company detects malware spreading through its internal network. Which containment method is most appropriate to stop the malware while keeping most services running?

A Ignore the malware and continue normal operations to avoid disruption

B Shut down the entire network immediately to stop all activity

C Isolate infected devices from the network but keep other segments operational

D Delete all user accounts to prevent access

💡 Hint

Think about how to stop the malware without stopping everything.

Isolating infected devices limits malware spread while allowing unaffected parts of the network to function.

❓ Comparison

advanced

Comparing containment strategies

Which statement correctly compares physical containment and logical containment in cybersecurity?

A Physical containment involves hardware isolation, while logical containment uses software controls like firewalls and access rules

B Physical containment is faster to implement than logical containment in all cases

C Both physical and logical containment mean disconnecting the internet connection

D Physical containment uses software firewalls, and logical containment disconnects cables physically

💡 Hint

Consider the difference between hardware and software methods.

Physical containment isolates devices or hardware, while logical containment uses software tools to control access and traffic.

❓ Reasoning

expert

Evaluating containment effectiveness

During a ransomware attack, a company applies containment by disconnecting affected systems from the network. However, the ransomware still encrypts files on disconnected devices. What does this indicate about the containment strategy?

A Containment was partially effective but failed to stop local encryption on devices

B Containment completely failed because the network was disconnected

C Containment was unnecessary since encryption happens only over the network

D Containment caused the ransomware to spread faster

💡 Hint

Think about what containment can and cannot stop.

Disconnecting devices stops network spread but cannot prevent ransomware from encrypting files already on the device.