What are the phases of incident response in order?
- A Preparation, detection and analysis, containment, eradication, recovery, lessons learned
- B Detection, blame, repair
- C Containment, reporting, closure
- D Analysis, escalation, dismissal
Answer
Preparation, detection and analysis, containment, eradication, recovery, lessons learned
Evidence must be preserved before containment destroys it, which is why memory capture and imaging precede rebuilding a host.





