Which are the main phases of an incident response lifecycle in POA?

• A. Planning, budgeting, staffing, evaluation.
• B. Preparation, detection/analysis, containment, eradication, recovery, and lessons learned.
• C. Detection, isolation, destruction, deletion.
• D. Initiation, execution, closure, archival.

Answer: (B)

The incident response lifecycle is a structured sequence that guides how security teams handle threats from start to finish, including learning for future improvement. The six phases shown here provide a complete flow: preparation sets up the IR capabilities—policies, roles, training, tools, and communication plans so the team is ready. Detection and analysis involve monitoring, triage, and quickly understanding what happened, how it affects the organization, and the scope of impact. Containment focuses on stopping the threat from spreading, which may mean isolating affected systems or tightening network controls. Eradication goes deeper to remove the attacker’s footholds and artifacts, patch vulnerabilities, and ensure compromised components are clean. Recovery brings systems back to normal operation, validating completeness and monitoring for any signs of remaining issues. Finally, lessons learned involve a post-incident review to capture what went well and what didn’t, and to update policies, procedures, and defenses accordingly. Other options mix in budgeting, destruction, or project-like stages that don’t align with the end-to-end incident response workflow, which is why they don’t fit as well.