Which list correctly represents the core phases of an incident response plan?

• A. Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Lessons Learned.
• B. Planning, Implementation, Evaluation.
• C. Detection, Response, Recovery.
• D. Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Lessons Learned.

Answer: (D)

The best answer follows the full incident response lifecycle: start with Preparation—having people, plans, and tools ready; then Detection and Analysis to identify whether an event is an incident and understand its scope; Containment to limit spread and impact while you decide on a course of action; Eradication to remove the root cause or attacker access; Recovery to restore normal operations and verify systems are clean; and Lessons Learned to review what happened and how to improve defenses and response for the future. This sequence covers both the immediate response steps and the essential post-incident learning that drives improvements. The other options miss or combine steps in ways that leave gaps—for example, omitting post-incident learning or not grouping the stages into a coherent lifecycle—so they don’t represent the complete, practical flow.