What stage of the incident handling process involves reporting events?

The correct answer is C. Identification. In the standard incident handling lifecycle (Preparation -> Identification -> Containment -> Eradication -> Recovery -> Follow-up/Lessons Learned), the Identification phase is where events are detected, reported, and classified as actual incidents. During Identification…

Submitted by tom_us· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AContainment
BFollow-up
CIdentification
DRecovery

How the community answered

(52 responses)

A
2% (1)
B
4% (2)
C
92% (48)
D
2% (1)

Explanation

In the standard incident handling lifecycle (Preparation -> Identification -> Containment -> Eradication -> Recovery -> Follow-up/Lessons Learned), the Identification phase is where events are detected, reported, and classified as actual incidents. During Identification, analysts review alerts, logs, and user reports to determine whether a security event constitutes a genuine incident, assess its scope and severity, and formally document and report it. Reporting is the trigger that moves the organization from passive detection into active response. The other phases occur after identification: Containment limits damage, Recovery restores systems, and Follow-up documents lessons learned.

Topics

#Incident handling process#Incident response stages#Identification stage#Event reporting

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice