Which phase of incident response involves containment, eradication, and recovery?

• A. Response
• B. Preparation
• C. Monitoring
• D. Prevention

Answer: (A)

Containment, eradication, and recovery are actions taken during the incident response phase. In the incident response life cycle, activities are organized into phases that handle events after detection and during handling. Preparation sets up the program and controls before incidents happen; monitoring focuses on detecting and watching for incidents; and the response phase is where you actively contain the incident to prevent further damage, eradicate the root cause, and recover normal operations. Containment stops the spread, eradication removes the threat, and recovery restores systems to normal functioning and validates they’re clean. The other options describe pre-incident readiness (preparation), ongoing detection (monitoring), or preventive measures to reduce incidents (prevention).