Which of the following incident response steps occurs before containment?

Which of the following incident response steps occurs before containment?
A . Eradication
B. Recovery
C. Lessons learned
D. Identification

View Answer

Answer: D

Explanation:

Identification is the first step in the incident response process, which involves recognizing that an incident has occurred. Containment is the second step, followed by eradication, recovery, and lessons learned.

References: CompTIA Security+ Study Guide, Exam SY0-601, 4th Edition, Chapter 10: Incident Response and Recovery, pp. 437-441.