Which of the following sets comprises the steps in the incident management lifecycle?

• A. Preparation, detection, containment, eradication, recovery, and post-incident review.
• B. Detection, containment, escalation, and closure.
• C. Preparation, detection, containment
• D. Preparation, response, recovery, and closure

Answer: (A)

Understanding the incident management lifecycle means tracing the sequence of steps teams follow to handle a security incident from start to learnings. It begins with preparation—building playbooks, training, backups, and defenses so you’re ready to act. Then comes detection and analysis, where you recognize an incident and determine its scope. Next is containment, which limits impact by isolating affected systems. After containment, eradication removes the root cause, such as removing malware or closing exploited vulnerabilities. Recovery focuses on restoring normal operations and verifying systems are safe. Finally, a post-incident review or lessons learned evaluates what happened and updates procedures to prevent repeats.

This set is the best match because it includes every phase of the lifecycle in the proper order, from preparation through to post-incident review. The other options omit important stages or substitute different terms (for example, lacking preparation or post-incident learning, or replacing containment and eradication with a different step), so they don’t represent the complete lifecycle.