Which phase follows detection/analysis in the incident response lifecycle?

Which phase follows detection/analysis in the incident response lifecycle?

• A. Preparation
• B. Post-incident lessons learned
• C. Planning
• D. Containment/eradication/recovery

Answer: (D)

After detection and analysis, the next focus is to contain the incident, eradicate the threat, and recover operations. Containment stops the incident from spreading and limits further damage by isolating affected systems. Eradication clears the root cause, such as removing malware or closing the exploited vulnerability. Recovery brings systems back to normal operation, validates that they’re clean, and monitors for signs of reinfection. Only after the environment is stabilized do teams move on to lessons learned to improve future responses. Preparation and planning are ahead of incidents, serving as readiness activities, while post-incident lessons learned come after recovery.

After detection and analysis, the next focus is to contain the incident, eradicate the threat, and recover operations. Containment stops the incident from spreading and limits further damage by isolating affected systems. Eradication clears the root cause, such as removing malware or closing the exploited vulnerability. Recovery brings systems back to normal operation, validates that they’re clean, and monitors for signs of reinfection. Only after the environment is stabilized do teams move on to lessons learned to improve future responses. Preparation and planning are ahead of incidents, serving as readiness activities, while post-incident lessons learned come after recovery.