Which sequence correctly represents the typical incident response lifecycle?

• A. Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
• B. Preparation, Containment, Identification, Eradication, Recovery, Lessons Learned
• C. Identification, Preparation, Containment, Eradication, Recovery, Lessons Learned
• D. Preparation, Containment, Identification, Eradication, Recovery, Lessons Learned

Answer: (A)

In incident response, you first build the capability to react effectively. Preparation covers policy, roles, tools, and training so the team can act quickly when something happens. Once an incident is detected, Identification is conducted to understand what occurred, its scope, which systems are affected, and how severe it is. With that understanding, Containment aims to limit the spread and impact, preventing further harm while the team works on remediation. Eradication then removes the root cause and patches or mitigates the underlying vulnerability to stop the incident from recurring. Recovery focuses on restoring operations and validating that systems are clean and functioning normally before full service is restored. Finally, Lessons Learned reviews what happened, what worked, and what to improve in processes, controls, and defenses for the future. This order—Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned—follows the typical incident response lifecycle and explains why the other sequences don’t fit, such as trying to contain before knowing the incident or skipping readiness activities. It aligns with well-known frameworks like NIST SP 800-61.