CompTIA Security+ Certification SY0-601: The Total Course - Chapter 13 Exam Question Review

The video tutorial discusses an intrusion detection alarm that alerts suspicious activity on a user workstation. The immediate response is to disable the network switch port connected to the workstation. This action is defined as 'containment,' which prevents the device from communicating on the network. The tutorial clarifies that containment is not recovery, prevention, or detection, but a temporary measure to control the incident.

What new insight or understanding did you gain from this video?