In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?

A. identification

B. Preparation

C. Lessons learned

D. Eradication

E. Recovery

F. Containment

 

Correct Answer: F

This question is in SY0-601 exam
For getting CompTIA Security+ certificate