Which of the following activities is the first stage in the incident response process?

The correct answer is A. Detection. Detection is the first stage because you cannot respond to an incident you don't know about - it is the trigger that initiates the entire response lifecycle. Before anything else can happen, a potential incident must be identified through monitoring, alerts, user reports, or…

Submitted by asante_acc· Mar 6, 2026Security operations

Question

Options

ADetection
BDeclaration
CContainment
DVerification

How the community answered

(63 responses)

A
90% (57)
B
3% (2)
C
5% (3)
D
2% (1)

Explanation

Detection is the first stage because you cannot respond to an incident you don't know about - it is the trigger that initiates the entire response lifecycle. Before anything else can happen, a potential incident must be identified through monitoring, alerts, user reports, or automated tools.

Declaration (B) comes after detection and verification, when a responsible party formally acknowledges and names an incident as such. Containment (C) is a mid-process activity that limits the spread of an incident after it has already been detected and assessed. Verification (D) occurs after initial detection to confirm that what was detected is a genuine incident rather than a false positive - making it the second stage, not the first.

Memory tip: Think of the mnemonic "D-V-C-E" - Detect, Verify, Contain, Eradicate - you can't do anything until you've seen the fire (Detection is always the spark that starts the response chain).

Topics

#Incident Response#Incident Response Process#Detection#Security Operations

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice