Which phase of the incident response lifecycle involves identifying indicators of compromise and acknowledging an incident?

• A. Preparation
• B. Identification
• C. Containment
• D. Recovery

Answer: (B)

Recognizing and confirming that an incident is happening based on detected signals is what this phase is about. Here, security teams analyze alerts, correlate events, and determine whether indicators of compromise truly indicate a breach. The goal is to verify the incident, understand its scope, identify affected systems, and classify its severity so responders know what to prioritize. Acknowledging the incident at this point begins the formal incident response process, triggering notifications, roles, and the escalation path.

Preparation, in contrast, is about having plans, tools, and trained staff ready before anything occurs. Containment follows identification and focuses on stopping the attacker from spreading further. Recovery centers on restoring operations and cleaning up before returning to normal business activity.