A user reports that a mobile application is working very slowly.

The containment phase of the incident response lifecycle is focused on limiting the impact of an active incident and preventing it from continuing or spreading further. In this scenario, the organization is experiencing a suspected Distributed Denial-of-Service (DDoS) attack, as indicated by high-volume traffic and degraded application performance.

During containment, the Computer Security Incident Response Team (CSIRT) takes immediate actions such as rate limiting, blocking malicious IP addresses, diverting traffic through scrubbing services, or engaging DDoS mitigation providers. The goal is to stabilize services and ensure that the attack no longer affects business operations. This phase also includes confirming that defensive measures have been successfully applied.

Preparation occurs before an incident and involves planning and readiness activities. Eradication focuses on removing the root cause of the incident, such as disabling attacker infrastructure or removing malware, which is not applicable to most DDoS scenarios. Recovery occurs after containment and involves restoring systems to normal operation and monitoring for recurrence.

Cybersecurity operations documentation clearly defines containment as the phase where ongoing attacks are stopped or controlled. Therefore, containment is the correct answer.