In incident response, what is the overall goal?

• A. To restore operations and learn from incidents to improve defenses.
• B. To automate all security controls.
• C. To isolate all users during an incident.
• D. To minimize the use of security staff.

Answer: (A)

Getting systems back online quickly while using the incident to strengthen defenses is what incident response aims to accomplish. After containment, recovery focuses on restoring operations and validating that affected services are safe to resume normal use. The lessons learned feed improvements to procedures, controls, and monitoring so future incidents are less likely to recur. The other ideas don’t fit the overall goal: automating every security control isn’t realistic or the primary objective, isolating all users is not typically the goal, and minimizing security staff would undermine the effectiveness of the response.