Containment for Beginners: Bootcamp Module
RCCE students will learn incident containment strategies including network isolation, account suspension, system quarantine, and threat neutralization during active security incidents. RCCE students will learn to make rapid containment decisions that balance security with business continuity, implement network-level containment using firewall rules and VLAN isolation, execute host-level containment through endpoint isolation and process termination, contain compromised accounts through credential reset and session revocation, document containment actions for forensic and legal purposes, and coordinate containment activities across distributed teams and environments. Designed for students with no prior experience in this area, this course builds knowledge from the ground up with clear explanations, guided demonstrations, and progressive skill-building. Building on core knowledge, RCCE students will learn core concepts through practical examples that connect theory to real-world security operations. By completion, students will have the foundational knowledge and hands-on confidence needed to contribute in professional cybersecurity roles.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Containment for Beginners: Bootcamp Module
- Execute hands-on tasks for what is incident containment?
- Execute hands-on tasks for why it matters
- Execute hands-on tasks for goal 3: enable recovery — covering Prevent lateral.
- Build detections and response workflows for privilege escalation
- Execute hands-on tasks for → containment → eradication → recovery →
- Execute hands-on tasks for containment phase details — covering Triggered after detection confirms a true incident.
- Execute hands-on tasks for core containment objectives
- Execute hands-on tasks for limit damage
- Execute hands-on tasks for maintain operations
- Execute hands-on tasks for preserve evidence
- Execute hands-on tasks for eradication support — covering Immediate response.
| Module 01 | What Is Incident Containment? |
| Module 02 | Why It Matters |
| Module 03 | Goal 3: Enable Recovery |
| Module 04 | Incident Response Lifecycle |
| Module 05 | → Containment → Eradication → Recovery → |
| Module 06 | Containment Phase Details |
| Module 07 | Core Containment Objectives |
| Module 08 | Limit Damage |
| Module 09 | Maintain Operations |
| Module 10 | Preserve Evidence |
| Module 11 | Coordinate Response |
| Module 12 | Eradication Support |
| Module 13 | Containment Decision Framework |
| Module 14 | Damage Potential |
All hands-on labs run on Rocheston Rose X OS. Students practice containment for beginners: bootcamp module by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for what is incident containment?
- Lab 2: Execute hands-on tasks for why it matters
- Lab 3: Execute hands-on tasks for goal 3: enable recovery
- Lab 4: Build detections and response workflows for privilege escalation
- Lab 5: Execute hands-on tasks for → containment → eradication → recovery →
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Containment for Beginners: Bootcamp Module, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI