What are the core phases of incident response?

• A. Planning, Investigation, Isolation.
• B. Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity.
• C. Detect, Respond, Recover.
• D. Monitoring, Alerting, Reporting.

Answer: (B)

The set of steps security teams follow when handling incidents includes Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. This sequence covers the full lifecycle of an incident, from readiness to learning and improving defenses after an incident.

Preparation establishes the groundwork: policies, roles, training, tooling, and runbooks so responders know what to do and how to react quickly when something happens. Detection and Analysis is about spotting the incident, confirming it, assessing its scope and impact, and gathering evidence to guide the response. Containment aims to stop the spread and limit damage, balancing speed with preserving evidence for later steps. Eradication and Recovery focus on removing the threat, repairing or rebuilding affected systems, and restoring normal operations, followed by validating that systems are clean and functional. Post-Incident Activity (often called lessons learned) feeds insights back into defenses, updating playbooks, controls, and detections to reduce the chance of recurrence.

The other options miss important parts of the cycle: planning or investigation alone doesn’t capture the ongoing response, remediation, and learning aspects; a simplified Detect-Respond-Recover view omits preparation and post-incident improvements; and a focus on Monitoring, Alerting, or Reporting describes ongoing security operations rather than the complete, end-to-end incident response process.