Which is not a phase in the SANS incident response process?

• A. Avoidance
• B. Preparation
• C. Containment
• D. Eradication

Answer: (A)

Recognizing the official incident response lifecycle helps you see which activities are real phases. In the SANS model, the stages include Preparation, Containment, and Eradication (along with other steps like Identification, Recovery, and Lessons Learned). Avoidance is not a named phase within this lifecycle. Preparation sets up plans, tools, and training before an incident; Containment focuses on stopping the incident from spreading; Eradication involves removing the threat and fixing underlying issues so the environment can be restored. Because Avoidance isn’t part of the formal SANS incident response stages, it’s the correct choice for what is not a phase.