🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Incident Response › Lesson 6
TEC-CYBE44-07 · Lesson 6 · 14 clock hours · demo

Containment Strategies: Network Isolation and System Quarantine

Objective. Students will demonstrate at least three containment techniques—network isolation, firewall rule insertion, and endpoint quarantine—without destroying forensic evidence.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Containment Comes Before Eradication

When a security incident is confirmed, the instinct is to wipe the infected machine and move on. Resist that instinct. Rushing to eradicate malware before you contain the threat lets attackers spread laterally, exfiltrate more data, or destroy evidence you will need for forensics and legal proceedings. The NIST SP 800-61 incident response lifecycle places containment as a distinct phase that must happen before eradication or recovery. Your job in this phase is to stop the bleeding while keeping the patient alive—and keeping the evidence intact.

The Three Core Containment Techniques

1. Network Isolation

Network isolation cuts an infected host off from the rest of the network so malware cannot spread, receive new commands, or exfiltrate data. In a virtualized lab environment, you accomplish this by changing the virtual network adapter on the suspect VM from a bridged or NAT mode to host-only or a completely isolated internal network segment. This severs outside connectivity while leaving the VM powered on.

Critical evidence-preservation rule: Do not power off the machine before capturing a memory image. Volatile data—running processes, active network connections, encryption keys loaded in RAM—disappears the moment power is cut. Tools such as Magnet RAM Capture or FTK Imager can acquire a live memory dump while the VM remains running. Only after that dump is saved should you change network settings.

In physical environments, isolation may mean pulling a network cable, disabling a switch port via the management console (preferred because it avoids touching the machine), or moving the host to an isolated VLAN. Document every action with a timestamp.

2. Firewall Rule Insertion

Sometimes full isolation is too disruptive—a web server cannot go completely dark during business hours. In those cases you use targeted firewall rules to block only the malicious traffic while allowing legitimate traffic to continue. This is called partial containment.

On a Windows host, the built-in Windows Defender Firewall with Advanced Security lets you create outbound rules that block traffic to specific IP addresses or CIDR ranges. For example, if your threat intelligence identifies a command-and-control (C2) server at a known IP range, you insert an outbound block rule for that range. After adding the rule, verify it works: attempt a connection to the blocked IP (using `Test-NetConnection` in PowerShell or a similar tool) and confirm the connection fails. Log the verification result.

At the network perimeter, a firewall or router ACL can block the attacker's source IP inbound. On a pfSense firewall, you navigate to Firewall > Rules, select the appropriate interface, and add a block rule matching the attacker's source IP or range. Place the block rule above any permissive rules so it is evaluated first. Again, test and document.

3. Endpoint Quarantine

Modern endpoint detection and response (EDR) platforms offer a quarantine function that isolates a host at the software level—blocking all network communication except the EDR management channel—without requiring physical access. This preserves your ability to continue collecting telemetry from the host. If your environment does not have an EDR tool, you can simulate quarantine in the lab by using host-based firewall rules to block all inbound and outbound traffic except a specific management IP, effectively achieving the same result.

Endpoint quarantine is especially useful when the suspect machine is a laptop that is off-site or a server in a remote data center where you cannot physically touch the hardware.

Documenting the Trade-Off Decision

Every containment choice carries a trade-off. Full isolation stops all risk of spread but may take a critical service offline. Partial containment keeps the service running but leaves some attack surface open. You must document:

This documentation becomes part of the chain of custody and the after-action report. Regulators, legal counsel, and leadership will rely on it.

Safety and Professional Practice Points

Cybersecurity lab work does not involve physical electrical hazards in the same way as electrical trades, but professional safety practices still apply:

Connecting to Your Credentials

CompTIA Security+ tests containment concepts under the Incident Response domain. CompTIA CySA+ goes deeper, requiring you to analyze threat indicators and select appropriate containment strategies based on evidence. ISC2 CC covers the importance of preserving evidence and following an IR process. All three credentials expect you to know that containment precedes eradication and that evidence integrity is non-negotiable.

Key terms9

Network isolationThe act of severing an infected or suspect host's network connectivity—physically, at the switch, or via virtual network settings—to prevent lateral movement or data exfiltration while keeping the host powered on.
Partial containmentA containment strategy that blocks only the specific malicious traffic (such as a known attacker IP) using firewall rules, while allowing legitimate traffic to continue for business continuity.
Endpoint quarantineA software-level isolation of a host, typically performed by an EDR platform, that blocks all network communication except the management channel so the host can still be monitored and controlled remotely.
Volatile dataInformation stored in RAM—including running processes, active network connections, and encryption keys—that is permanently lost when a machine is powered off.
Memory acquisitionThe process of capturing the contents of a live system's RAM into a file for forensic analysis before isolation or shutdown destroys that volatile evidence.
Chain of custodyA documented, chronological record of who collected, handled, transferred, or analyzed evidence, used to prove that evidence has not been altered or tampered with.
Command-and-control (C2)Infrastructure operated by an attacker—often a remote server or IP range—used to send instructions to malware installed on compromised hosts and receive stolen data.
Lateral movementTechniques attackers use to progressively move through a network from an initial compromised host to additional systems, often seeking higher privileges or more sensitive data.
Host-based firewall ruleA traffic filtering rule applied on the operating system of an individual endpoint—such as Windows Defender Firewall—rather than on a network device, controlling what traffic the host itself sends or accepts.
In class: Instructor demonstrates isolating an infected VM from the network using virtual switch settings in VMware or VirtualBox while preserving live memory state; students replicate the procedure in their own lab environment. · Students configure a host-based firewall rule on a Windows lab VM to block all outbound traffic to a simulated command-and-control IP range, then verify the block using a connection test. · Practice 'partial containment' on a web server scenario: block the attacker's source IP at the perimeter firewall rule while keeping the server online for business continuity; document the trade-off decision in writing.
Materials: VMware Workstation Player or VirtualBox, Windows Server lab VM, pfSense or simulated firewall console, student lab guides, documentation template
Check: Step-by-step competency checklist signed off by instructor: student must successfully complete isolation, rule insertion, and quarantine steps with no evidence destruction; all three steps must pass.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Incident Response
1. An analyst confirms that a workstation is infected with malware that is actively communicating with a remote server. Before changing any network settings, what should the analyst do first?
Incident Response
2. In a VMware or VirtualBox lab environment, which action best achieves network isolation of a suspect VM while keeping the VM powered on?
Threats, Attacks, and Vulnerabilities
3. A security team needs to block outbound traffic from a Windows Server to a known C2 IP range without taking the server offline. Which tool built into Windows should they use?
Incident Response
4. After adding a firewall rule to block a C2 IP range, how should an analyst verify that the rule is working correctly?
Incident Response
5. A company's public web server is under attack but cannot be taken offline during business hours. The incident commander decides to block only the attacker's source IP at the perimeter firewall. This is an example of which strategy?
Security Operations
6. Which of the following BEST describes the advantage of using an EDR platform's quarantine function over physically unplugging a machine's network cable?
Incident Response
7. According to NIST SP 800-61 incident response guidance, in what order do the following phases occur?
Incident Response
8. An analyst is documenting a containment decision to keep a compromised server partially online rather than fully isolating it. Which information is MOST important to include in that documentation?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →