Each of the following is a valid step in handling incidents except ____________

Containment is a crucial step to limit the scope and impact of an incident.

The standard incident response process, often guided by frameworks like NIST SP 800-61, includes phases such as Preparation, Identification, Containment, Eradication, Recovery, and Post-Incident Activity (Lessons Learned/Review). While legal action might follow an incident, "prosecute" is a legal action taken by law enforcement or legal teams, not a direct step in the technical and operational incident handling process.

Recovery is a vital step to restore affected systems and services to normal operation.

Review (or Lessons Learned) is essential for improving future incident response capabilities.

Identification is the initial step of determining whether an event is indeed an incident.

Preparation is the foundational step that ensures an organization is ready to handle incidents effectively.