Which two elements of the incident response process are stated in NIST Special Publication 800- 61 r2? (Choose two.)

"Detection and Analysis" is a core phase in the NIST 800-61 r2 incident response lifecycle, focusing on identifying security incidents and understanding their scope and impact.

"Post-Incident Activity" (often referred to as Post-Incident Recovery or Lessons Learned) is another critical phase in NIST 800-61 r2, ensuring that lessons are learned and improvements are made after an incident.

"Vulnerability management" is a proactive security practice that helps prevent incidents but is not listed as a distinct phase within the incident response process itself in NIST 800-61 r2.

"Risk assessment" is a foundational security activity that informs incident response planning but is not a phase of incident response described in NIST 800-61 r2.

"Vulnerability scoring" is a component of vulnerability management and risk assessment, not a specific phase within the incident response lifecycle defined by NIST 800-61 r2.