In the middle of a cybersecurity, a security engineer removes the infected devices from the network and lock down all compromised accounts.
In which of the following incident response phases is the security engineer currently operating?
A . Identification
B . Preparation
C . Eradiction
D . Recovery
E . Containment
Answer: E