Which sequence correctly outlines the general steps of incident response relevant to inquiries?

Which sequence correctly outlines the general steps of incident response relevant to inquiries?

• A. Contain, identify, recover, eradicate, and review.
• B. Identify, contain, eradicate, recover, and review.
• C. Identify, contain, eradicate, recover, and review.
• D. Identify, contain, eradicate, review, and recover.

Answer: (C)

This sequence reflects the incident response flow from spotting an issue to learning from it. Start by identifying what happened so you can determine scope, affected assets, and the actions needed. Once you understand the incident, contain it to stop any further damage or spread. After containment, eradicate the threat and remove malicious artifacts to ensure the system is clean. With the threat gone, proceed to recover—restore services, data, and operations to normal functioning, validating that systems are safe. Finally, review what occurred to capture lessons learned and improve defenses and response plans for future incidents. Starting with containment or attempting recovery before eradication can lead to misjudging the scope or reintroducing the threat, and reviewing too early won’t address restoration or root causes.

This sequence reflects the incident response flow from spotting an issue to learning from it. Start by identifying what happened so you can determine scope, affected assets, and the actions needed. Once you understand the incident, contain it to stop any further damage or spread. After containment, eradicate the threat and remove malicious artifacts to ensure the system is clean. With the threat gone, proceed to recover—restore services, data, and operations to normal functioning, validating that systems are safe. Finally, review what occurred to capture lessons learned and improve defenses and response plans for future incidents.

Starting with containment or attempting recovery before eradication can lead to misjudging the scope or reintroducing the threat, and reviewing too early won’t address restoration or root causes.