Which steps comprise a basic incident response lifecycle?

• A. Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned
• B. Prevention, mitigation, recovery, and reporting
• C. Identification, containment, restoration, and archiving
• D. Planning, testing, deployment, and decommissioning

Answer: (A)

The basic incident response lifecycle is a sequence that starts with getting ready and equipped to handle incidents, then moves through recognizing what happened, containing the impact, removing the cause, restoring operations, and finally learning from the event to improve defenses. This set of steps—preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned—covers the full process from the moment an incident is identified to the actions taken after to reduce future risk. The other options miss or jumble essential phases: one focuses on prevention and reporting rather than managing an active incident; another may omit eradication or post-incident learning; and a different one centers on planning or deployment rather than the actual incident handling workflow.