In an incident response plan, what are the phases of the incident response lifecycle? (Select all that apply)

Detection and analysis involves continuously monitoring for security events and carefully examining identified anomalies to confirm an incident and understand its scope.

Recovery focuses on restoring affected systems and services to their normal operational state, ensuring business continuity after an incident has been contained and eradicated.

Prevention is a proactive measure taken before an incident occurs to reduce its likelihood, and while crucial for security, it is not a phase within the incident response lifecycle itself.

Containment aims to limit the impact of an incident by isolating affected systems or networks, preventing the attack from spreading further and minimizing damage.