Containment strategies in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding containment strategy types

Which of the following best describes a segmentation containment strategy in cybersecurity?

A Backing up data regularly to restore systems after an attack

B Completely shutting down all network connections to stop an attack immediately

C Using antivirus software to detect and remove malware from infected devices

D Separating network segments to limit the spread of an attack within different parts of the network

💡 Hint

Think about how dividing a network can help control where an attacker can go.

Segmentation containment involves dividing a network into smaller parts to prevent attackers from moving freely. This limits damage and helps isolate threats.

📋 Factual

intermediate

Key goal of containment strategies

What is the primary goal of containment strategies during a cybersecurity incident?

A To identify the attacker’s identity quickly

B To limit the damage and prevent the attack from spreading further

C To immediately restore all affected systems to normal operation

D To delete all data on infected devices

💡 Hint

Containment focuses on controlling the incident, not on recovery or identification.

The main purpose of containment is to stop the attack from causing more harm by limiting its reach.

🔍 Analysis

advanced

Choosing the right containment method

A company detects malware spreading through its internal network. Which containment method is most appropriate to stop the malware while keeping most services running?

A Ignore the malware and continue normal operations to avoid disruption

B Shut down the entire network immediately to stop all activity

C Isolate infected devices from the network but keep other segments operational

D Delete all user accounts to prevent access

💡 Hint

Think about how to stop the malware without stopping everything.

Isolating infected devices limits malware spread while allowing unaffected parts of the network to function.

❓ Comparison

advanced

Comparing containment strategies

Which statement correctly compares physical containment and logical containment in cybersecurity?

A Physical containment involves hardware isolation, while logical containment uses software controls like firewalls and access rules

B Physical containment is faster to implement than logical containment in all cases

C Both physical and logical containment mean disconnecting the internet connection

D Physical containment uses software firewalls, and logical containment disconnects cables physically

💡 Hint

Consider the difference between hardware and software methods.

Physical containment isolates devices or hardware, while logical containment uses software tools to control access and traffic.

❓ Reasoning

expert

Evaluating containment effectiveness

During a ransomware attack, a company applies containment by disconnecting affected systems from the network. However, the ransomware still encrypts files on disconnected devices. What does this indicate about the containment strategy?

A Containment was partially effective but failed to stop local encryption on devices

B Containment completely failed because the network was disconnected

C Containment was unnecessary since encryption happens only over the network

D Containment caused the ransomware to spread faster

💡 Hint

Think about what containment can and cannot stop.

Disconnecting devices stops network spread but cannot prevent ransomware from encrypting files already on the device.

Practice

1. What is the main goal of containment strategies in cybersecurity?

easy

A. To improve system performance

B. To recover lost data after an attack

C. To identify the attacker's location

D. To stop a cyber attack from spreading further

Solution

1. Step 1: Understand containment purpose

   Containment strategies focus on limiting damage during an attack.

2. Step 2: Identify the key goal

   The key goal is to stop the attack from spreading to other systems.

3. Final Answer:

   To stop a cyber attack from spreading further -> Option D

4. Quick Check:

   Containment = Stop spread [OK]

Hint: Containment means stopping spread quickly [OK]

Common Mistakes:

• Confusing containment with recovery
• Thinking containment finds attackers
• Assuming containment improves speed

2. Which of the following is a correct containment action during a cyber attack?

easy

A. Disconnecting affected devices from the network

B. Running a full system backup after the attack ends

C. Increasing user privileges to speed recovery

D. Ignoring alerts to avoid false alarms

Solution

1. Step 1: Identify containment actions

   Containment involves isolating affected systems to stop spread.

2. Step 2: Evaluate options

   Disconnecting devices stops attackers from moving laterally.

3. Final Answer:

   Disconnecting affected devices from the network -> Option A

4. Quick Check:

   Isolation = Disconnect devices [OK]

Hint: Containment isolates affected devices fast [OK]

Common Mistakes:

• Confusing containment with recovery steps
• Thinking increasing privileges helps containment
• Ignoring alerts delays response

3. Consider this scenario: A malware infection is detected on a company computer. Which containment step should happen first?

medium

A. Notify all employees to change passwords immediately

B. Disconnect the infected computer from the network

C. Run a full antivirus scan on all company devices

D. Delete all files on the infected computer

Solution

1. Step 1: Analyze immediate containment needs

   Stopping spread requires isolating the infected device quickly.

2. Step 2: Choose the first containment action

   Disconnecting the infected computer prevents malware from spreading.

3. Final Answer:

   Disconnect the infected computer from the network -> Option B

4. Quick Check:

   First step = Disconnect infected device [OK]

Hint: Isolate infected device before other actions [OK]

Common Mistakes:

• Starting with password changes instead of isolation
• Running scans before stopping spread
• Deleting files without backup

4. A company tried to contain a ransomware attack by disconnecting only some infected devices. Why might this containment fail?

medium

A. Because ransomware cannot spread over networks

B. Because disconnecting devices causes data loss

C. Because attackers can spread through other connected devices

D. Because containment requires deleting files immediately

Solution

1. Step 1: Understand partial containment risks

   Leaving some infected devices connected allows attackers to spread.

2. Step 2: Identify why partial isolation fails

   Attackers move through networked devices not fully isolated.

3. Final Answer:

   Because attackers can spread through other connected devices -> Option C

4. Quick Check:

   Partial isolation = Spread continues [OK]

Hint: Partial isolation lets attackers spread [OK]

Common Mistakes:

• Thinking disconnect causes data loss
• Believing ransomware can't spread via network
• Assuming deleting files is containment

5. A company uses network segmentation as a containment strategy. What is the main benefit of this approach?

hard

A. It limits attacker access to only parts of the network

B. It automatically removes malware from infected devices

C. It speeds up internet connection for all users

D. It prevents all cyber attacks completely

Solution

1. Step 1: Understand network segmentation

   Network segmentation divides a network into smaller parts to control access.

2. Step 2: Identify containment benefit

   This limits attackers to only one segment, preventing full network access.

3. Final Answer:

   It limits attacker access to only parts of the network -> Option A

4. Quick Check:

   Segmentation = Limit attacker access [OK]

Hint: Segmentation blocks attacker spread by sections [OK]

Common Mistakes:

• Thinking segmentation removes malware automatically
• Assuming segmentation improves internet speed
• Believing segmentation stops all attacks