In the NIST incident response lifecycle, which option lists the six phases including Preparation and Lessons Learned?

• A. Preparation
• B. Preparation, Detection and Analysis, Containment, Eradication, Recovery, Lessons Learned.
• C. Recovery and Lessons Learned
• D. Containment

Answer: (B)

Understanding the complete NIST incident response lifecycle means recognizing the six phases from planning to post-incident improvement. The correct option lists Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Lessons Learned, which covers the whole lifecycle. Preparation sets up readiness and playbooks; Detection and Analysis identify and assess incidents; Containment limits spread; Eradication removes the root cause; Recovery brings systems back online; Lessons Learned reviews the incident to strengthen defenses. The other options miss one or more phases (for example, they include only a single phase or only Recovery and Lessons Learned, or only Containment), so they do not reflect the full lifecycle.