Which of the following phases of the incident response process match the actions taken?

An incident at a government agency has occurred and the following actions were taken:

– Users have regained access to email accounts

– Temporary VPN services have been removed

– Host-based intrusion prevention system (HIPS) and antivirus (AV) signatures have been updated

– Temporary email servers have been decommissioned

Which of the following phases of the incident response process match the actions taken?
A . Containment
B. Post-incident
C. Recovery
D. Identification