Which two elements of the incident response process are stated in NIST SP 800-61 r2? (Choose two.)

'Detection and Analysis' is a core phase in the NIST incident response lifecycle, focusing on identifying security events, determining if they are incidents, and analyzing their scope and nature.

'Post-Incident Activity' is the final phase of the NIST incident response process, involving lessons learned, evidence retention, and using findings to improve future incident handling and overall security posture.

Vulnerability scoring is typically part of vulnerability management or risk assessment, not a distinct phase within the incident response process itself.

Vulnerability management is a proactive process for identifying, assessing, and remediating vulnerabilities, which is separate from the reactive incident response process.

Risk assessment is a broader security governance activity that identifies, evaluates, and prioritizes risks, rather than a specific step in handling an ongoing security incident.