CompTIA Security+ Certification SY0-601: The Total Course - Chapter 13 Exam Question Review

The video tutorial discusses an intrusion detection alarm that alerts suspicious activity on a user workstation. The immediate response is to disable the network switch port connected to the workstation. This action is defined as 'containment,' which prevents the device from communicating on the network. The tutorial clarifies that containment is not recovery, prevention, or detection, but a temporary measure to control the incident.

What does containment prevent in the context of an incident?

How does the intrusion detection system contribute to the incident response?