Name the four phases of the incident response lifecycle.

• A. Preparation; detection/analysis; containment/eradication/recovery; post-incident lessons learned
• B. Preparation; detection; containment; recovery
• C. Planning; execution; review; archiving
• D. Prevention; response; recovery; reporting

Answer: (A)

In incident response, you move through stages from preparation to learning after an incident, ensuring you’re ready, can identify what happened, can stop and recover from the incident, and then use what you learned to do better next time. The best sequence includes four phases: preparation; detection/analysis; containment/eradication/recovery; and post-incident lessons learned. Preparation builds the team, tools, and plans before anything happens. Detection and analysis identify that an incident is occurring and determine its scope. Containment, eradication, and recovery stop the incident, remove the threat, and restore normal operations. Post-incident lessons learned captures insights from the incident and feeds improvements back into the preparation and response process.

The other options miss important elements. One version splits detection from analysis and excludes a formal post-incident review, which leaves out the deeper examination that prevents repeats. Another uses generic project terms like planning and execution that don’t map to the security-focused cycle, and it omits the explicit containment/eradication steps and the learning phase. The last option centers on prevention and reporting rather than the actual sequence of preparing, detecting, stopping, restoring, and learning from an incident.