What are the four phases of the incident response lifecycle?

• A. Threat hunting, Quarantine, Restoration, Audit.
• B. Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity.
• C. Identification, Containment, Eradication, Recovery.
• D. Planning, Execution, Review, Closure.

Answer: (B)

Understanding the incident response lifecycle in four phases helps teams act quickly and effectively during security events. Preparation sets up everything needed before an incident happens—policies, roles, communication plans, training, and the tools to detect and respond. Detection and Analysis is where alerts are triaged, the incident is confirmed, its scope and impact are understood, and priorities are set. Containment Eradication and Recovery focuses on stopping the attack from spreading, removing the attacker’s access, and restoring normal operations while verifying systems are clean. Post-Incident Activity is the learning phase, where the response is reviewed, lessons are documented, and defenses are updated to prevent recurrence.

This option aligns with the standard model described in many security guidelines, making it the most comprehensive and accurate representation of the incident response lifecycle. The other choices mix in activities that aren’t part of the formal sequence (for example, treating incident response like a project-management cycle) or leave out a phase (such as post-incident learning or the explicit detection and analysis step).