What is the correct order of the six phases in the Incident Response Plan?

• A. Preparation, Containment, Identification, Eradication, Recovery, Lessons Learned
• B. Identification, Preparation, Containment, Eradication, Recovery, Lessons Learned
• C. Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
• D. Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned

Answer: (D)

You're being tested on the standard incident response lifecycle order. The sequence starts with Preparation to set up the team, tools, and playbooks; then Identification to detect and understand that an incident is occurring; next comes Containment to limit the incident’s impact; followed by Eradication to remove the threat from the environment; then Recovery to restore services and verify systems are clean; and finally Lessons Learned to review what happened and improve defenses.

This order is the most logical flow: you don’t contain or eradicate something you haven’t yet identified, and you don’t start recovery or learning until the incident is under control. The option that follows this exact progression—Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned—fits the model precisely. Other choices mix up steps (for example, attempting containment before proper identification, or skipping preparation), which breaks the workflow and undermines effective incident handling.