Cyber Defense · lesson 10 of 12 · 12 min

Incident response lifecycle

summary: Incident response is a repeatable process: prepare, detect and analyze, contain, eradicate, recover, and learn. Clear roles and documentation help teams respond calmly.

question: Which step follows detection and analysis?

options:

• Containment
• Ignoring the event
• Deleting evidence
• Publishing passwords

correct: Containment

explanation: Containment limits impact while the team continues its investigation.

---

Previous lesson: Intrusion detection concepts
Back to Cyber Defense
Next lesson: Containment and recovery