What are the steps of the NIST incident response lifecycle as listed in the material?

• A. Preparation; Containment; Eradication; Recovery; Detection and Analysis; Post-Incident Activity.
• B. Preparation; Containment; Eradication; Recovery; Detection and Analysis; Post-Incident Activity.
• C. Preparation; Detection and Analysis; Containment; Eradication; Recovery; Post-Incident Activity.
• D. Preparation; Detection; Containment; Recovery; Eradication; Post-Incident Activity.

Answer: (C)

The steps follow a logical flow from readiness to improvement after an incident. After you’re prepared, you need to detect and analyze what happened before taking action. Understanding the incident—its type, scope, affected assets, and potential data exposure—drives effective containment: you want to limit spread and impact based on real findings rather than guesses. With containment in place, the next phase is eradication, removing the root cause and any attacker footholds or artifacts so the threat is truly gone. After eradication, you focus on recovery to restore operations and verify that systems are clean and functional again. The final phase, Post-Incident Activity, is a reflection step: you review what occurred, capture lessons learned, and update your processes and controls to reduce the chance of recurrence. This ordering—Detection and Analysis before Containment, then Eradication, then Recovery, followed by Post-Incident Activity—best fits how you translate awareness into targeted action and continuous improvement.