Which phase of the incident response lifecycle involves identifying indicators of compromise and recognizing an incident?

• A. Identification
• B. Containment
• C. Recovery
• D. Preparation

Answer: (A)

Detection and initial assessment of security events involve identifying indicators of compromise and deciding whether a given activity qualifies as an incident. Indicators of compromise are artifacts that signal a breach—things like unusual network connections, unexpected file changes, known malware hashes, or compromised credentials. In this phase, analysts monitor alerts, sift through logs, and correlate data to confirm if activity is indeed an incident and to understand its scope and severity. This identification work tells you what to contain, eradicate, and later recover from. Preparation builds the defenses and playbooks for quicker detection; containment focuses on stopping the spread once an incident is identified; recovery aims to restore normal operations.