Skip to content
All articles
October 13, 2026 12 min read

Isolate, Segment, or Remove: Containment, Eradication, and Recovery Techniques the Way CySA+ Scenarios Test Them

Chris Rees

Chris Rees

25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings

Isolate, Segment, or Remove: Containment, Eradication, and Recovery Techniques the Way CySA+ Scenarios Test Them
Skillthropicwww.skillthropic.com

The alert fires at 04:12: mass file modification on a clinical file server. The on-call engineer knows the incident response lifecycle by heart and still has one hand on the power button, because knowing the phases is not the same as knowing which technique to use inside them. Objective 3.3 is the largest in CySA+ Domain 3, and it is tested almost entirely as scenarios: a situation, four techniques, and one that is right for the scope, the impact, and the evidence you still need.

Detection and analysis: prove it before you act

Every technique downstream depends on knowing what you are dealing with, and the objective names the analysis techniques the way the exam tests them: as a failure that happened because one was skipped.

Technique What it produces The failure the exam describes
Indicator of compromise analysis confirmation that the hash, address, domain or behavior in the alert is present, and where else a team contains one host while the same indicator sits on three others
Evidence acquisition memory, disk, logs, captured in order of volatility a host powered off before its memory was captured, with the keys in it
Chain of custody a record of who held each item, when, and why, unbroken from collection evidence that cannot be used because the form was filled in afterwards
Validation the alert checked against a second source before anything drastic happens a production system taken down over a false positive
Data and log analysis the timeline: correlated events across sources, enriched with asset and identity context a response scoped to the alert instead of the intrusion

The timeline is the product that matters. Correlated across SIEM, endpoint and identity logs, the 04:12 alert becomes a nineteen-day intrusion that began with a vendor's remote access account, harvested browser credentials on three hosts, and only became visible when encryption began. None of that was in the alert, and every containment decision depends on it. Evidence handling itself, the order of volatility and the forensic process, is Security+ material the exam assumes; the CySA+ addition is legal hold, which overrides a retention schedule the moment litigation is foreseeable.

The three questions that pick the technique

Before any containment choice, three things must be established, because every wrong answer in this objective is a technique applied without them.

Scope. How many hosts, which accounts, which segments, and which of them the adversary has already used. Containing the alerting host when the credentials are already on the domain controller contains nothing.

Impact. What the affected asset does for the business, what data it holds, what regulation covers that data, and how recoverable it is. Severity is assessed on those, not on how alarming the alert looked; a clinical system outranks billing, which outranks the meeting-room booking system.

Evidence still needed. Whether there is anything on the host, in memory or on disk, that the investigation cannot get anywhere else. If there is, any technique that destroys it comes after acquisition, not before.

Containment: isolate, segment, or remove

Containment stops the harm without stopping the investigation, and the objective offers three techniques that trade off differently.

A containment decision tree: once compromise is confirmed on a host, ask whether you still need what is running on it, the memory, keys, sessions and processes; if yes, isolate it, keeping it running with all traffic blocked through EDR isolation or a quarantine VLAN; if no, ask whether it must keep serving a critical function during the response; if yes, segment it so that only the flows it needs are allowed and every one is watched; if no, remove it from the network and rebuild it, after capturing memory and disk CONTAINMENT: WHAT MUST THE CHOICE PRESERVE? Compromise confirmed on a host. Contain it, but how? Do you still need what is running on it? memory, keys, sessions, processes: the evidence yes no Must it keep serving? clinical, revenue or safety critical yes no ISOLATE keep it running, block all traffic EDR isolation or a quarantine VLAN SEGMENT allow only the flows it needs and watch every one of them REMOVE take it off the network, rebuild it capture memory and disk first Isolation preserves evidence; segmentation preserves service; removal preserves neither, so it comes after acquisition.
Two questions decide it. The first is about evidence, the second about the business, and a stem that mentions either is telling you which branch to take.

Isolation cuts the host off from everything while leaving it running: an EDR network-isolation command, a quarantine VLAN, a switch port disabled. The adversary loses their channel; memory, running processes, and any keys in them survive; the responder can still reach it through the management channel. It is the default for a single compromised host with evidence on it.

Segmentation restricts the host or segment to the flows it must have and nothing else, with monitoring on every one. It is the right technique when the asset cannot stop serving: a clinical system, a revenue platform, an operational technology network where isolation would halt a physical process. It contains less and costs less, and a stem about a system "that must remain available during the response" is pointing at it.

Removal takes the asset off the network entirely, to be rebuilt or decommissioned. It is right when the host is disposable, when the scope is so large that isolation cannot keep up, or after acquisition is complete. Its only rule is ordering: capture first, remove second.

The method matters as much as the choice, because some methods destroy what others preserve.

Method What survives When it is the answer
EDR network isolation memory, running state, remote access for the responder almost always; the exam's preferred answer
Switch port disable or VLAN move memory and running state; no remote access no EDR agent, or the agent is compromised
Unplug the cable memory; nothing remote immediate, crude, acceptable
Power off disk only; memory, sessions and keys are gone never before memory capture; the exam's wrong answer

Eradication: removing the foothold

Containment stops the bleeding; eradication removes the cause, and the objective's list is the set of ways to do that.

Reimaging rebuilds the host from a known-good image. It is the answer whenever persistence cannot be ruled out, which for anything with a rootkit, a modified boot chain or an unknown dwell time is always. Cleaning a host by deleting the malware you found leaves the malware you did not find. Patching and vulnerability mitigation close the door the adversary used: the unpatched service, the exposed protocol, the vendor account with no MFA. Reimaging without closing the vector produces a clean host that is recompromised by the same route. Restoring permissions resets what the adversary changed: credentials rotated, group memberships reverted, tokens revoked, service accounts rekeyed, and it extends to every credential the timeline shows was touched, not just the one in the alert. Compensating controls cover the gap when the real fix cannot ship yet: segmentation around an unpatchable device, an additional monitoring rule, a temporary block. Secure disposal applies when the asset is not coming back: media sanitized, so that the evidence and the compromise leave together.

The exam's eradication trap is sequence. An adversary who notices you cleaning up before you have found everything burns their remaining access and digs in deeper, which is why eradication waits for the scope to be complete and why the attack frameworks exist: to name what has been found and what has not.

Recovery: earning trust back

Recovery returns systems to service, and the objective tests it as a set of conditions rather than a moment.

Restoring from backup means restoring from a validated clean copy that predates the compromise, in an order driven by business priority and dependency. A backup taken during the dwell period restores the adversary along with the data, which is why the timeline's start date matters more than the alert's. Verifying logging and monitoring confirms that the rebuilt system is sending telemetry again, that the detection gap the incident revealed has a rule now, and that the new rule fires on a test. A host restored without its agent is a blind spot with a fresh coat of paint. Hardening applies the baseline the host should have had, plus whatever the root cause demands. Validation is the proof: the vector is closed, credentials are reset, the host is clean or rebuilt, and enhanced monitoring is in place before it is released from isolation.

Worked example: the file server from the timeline is rebuilt from image, restored from the last backup before the vendor's first login, patched, and joined to the domain with new service credentials. Before it leaves the quarantine VLAN the team confirms the EDR agent is reporting, runs the credential-theft technique that never alerted and watches the new rule fire, and checks that the vendor account now requires MFA. Each of those is a release criterion. A host does not drift back onto the network because someone needs it on Monday.

The grid: every technique in its phase

A grid of the four incident response phases against the techniques the objective names in each and the question that picks the technique: detection and analysis uses IoC matching, evidence acquisition and log analysis to answer whether it is real and how far it reaches; containment chooses isolation, segmentation or removal by asking what must be preserved, evidence or service; eradication uses reimaging, patching and mitigation, and restoring permissions with compensating controls to answer whether the foothold is gone and the door closed; recovery restores from a validated backup, verifies monitoring, and hardens and validates to answer whether the system can be trusted again and whether the team would know if it could not FOUR PHASES, THE TECHNIQUES IN EACH, AND THE QUESTION THAT PICKS THEM TECHNIQUES THE DECIDING QUESTION Detection and analysis IoC matching hash, address, behavior Evidence acquisition volatile first, custody log Log and data analysis validate, correlate, scope Is it real, and how far does it reach? Containment Isolation running, no traffic Segmentation only the needed flows Removal offline, after acquisition What must be preserved: evidence or service? Eradication Reimage or rebuild from a known-good image Patch and mitigate close the vector, dispose Restore permissions reset creds, compensate Is the foothold gone, and the door closed? Recovery Restore from backup validated, pre-compromise Verify monitoring logging back, rule tested Harden and validate release criteria met Can it be trusted again, and would we know? The phase says what the technique must achieve; the question says whether it was the right one.
Twelve techniques, four questions. A scenario stem describes one cell; the phase it belongs to tells you what a correct answer has to accomplish.

The grid is how to read a stem. Place the situation in a phase: is the team still working out what happened, stopping the harm, removing the cause, or bringing service back? Then ask the phase's question. A technique that answers a different phase's question is the distractor: patching during detection, restoring from backup before eradication, powering off during containment.

Four stems, decoded

  1. Ransomware is encrypting a file server; the responder wants to stop it and preserve the chance of recovering the key. Isolate with EDR or a quarantine VLAN, never power off. The key may still be in memory, and the process can be captured while it runs.
  2. A patient-scheduling system is compromised and cannot be taken offline without cancelling clinics. Segment: restrict it to the flows the clinics need, monitor every one, and plan the rebuild for the maintenance window.
  3. After removing the malware found on a host, the team returns it to service and it is recompromised within a day. Eradication failed twice: the host was cleaned rather than reimaged, and the vector was never closed. Rebuild, patch, rotate the credentials.
  4. A rebuilt server is restored from the most recent backup, taken a week before the alert. The timeline shows a nineteen-day dwell, so the backup contains the adversary. Restore from a copy that predates initial access and validate before release.

Key takeaways

  • Analysis first: IoC, acquisition, custody, validation, timeline. The timeline, not the alert, sets the scope, and legal hold beats the retention schedule.
  • Isolate to keep evidence, segment to keep service, remove after acquisition. EDR isolation is the exam's preferred method; power off is its wrong answer.
  • Eradication means reimage plus close the vector plus reset every touched credential. Cleaning finds the malware you found; compensating controls cover what cannot be fixed yet.
  • Recovery is a set of conditions. Backup predating the compromise, monitoring verified with a test, hardened, validated, then released.
  • Scope, impact, and evidence pick the technique. A technique that answers another phase's question is the distractor.

Incident response techniques are objective 3.3 of CySA+ Domain 3, Incident Response and Management, 24% of the exam. They are the working detail beneath the seven-phase process and the frameworks that name an attack. Work all 18 topics with our free CySA+ Domain 3 study guide.

#CySAplus #CS0004 #IncidentResponse #Containment #Eradication #Recovery #ChainOfCustody #BlueTeam #InfoSec #CyberSecurity

CySA+ Domain 3 · 24% of the exam

Know the attack before you answer it

Incident Response and Management is a quarter of CySA+ CS0-004. Work all 20 topics across three objectives, from the Kill Chain, Diamond Model and ATT&CK through the response process and the techniques of containment, eradication and recovery, with 60 practice questions.

Get the CySA+ Domain 3 guide

Share this article

Keep reading

CySA+ deep dives

Kill Chain, Diamond Model, ATT&CK: Three Maps of the Same Attack, and When to Use Each

CySA+ gives you three frameworks for describing an attack and then asks which one fits the question. The Cyber Kill Chain's seven phases and where to break them, MITRE ATT&CK's tactics versus techniques and why the IDs matter, the Diamond Model's four vertices and how analysts pivot across them, all aligned on one intrusion so you can see what each map shows and hides.

Read CySA+ deep dives

Credentialed or Not, Agent or Agentless: How to Choose the Scan Before You Read the Report

The most expensive vulnerability report is the one that scanned the wrong way. CySA+ objectives 2.1 and 2.2: internal versus external, credentialed versus non-credentialed and why the difference is thousands of findings, agent versus agentless, active versus passive, the frameworks that dictate scan scope, and how to read Nmap's open, closed and filtered without guessing.

Read CySA+ deep dives

Open, Filtered, Plugin Output: Reading Nmap, Nessus, and Nikto Line by Line the Way CySA+ Expects

A scanner does not report facts. It reports claims, each resting on a specific piece of evidence, and a Critical built on a version banner arrives in the same red as one built on a working exploit. CySA+ objective 2.2 puts the output in front of you and asks what it means. Nmap states and NSE scripts, the anatomy of a Nessus finding, Nikto and Burp output, and the evidence test that separates a true positive from a false one.

Read

Enjoyed this? Get the AI security news that matters.

Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.

No spam. Unsubscribe anytime.