Malware Incident Response includes which phases in the listed sequence?

• A. Preparation, detection, containment, eradication, recovery, lesson learned
• B. Preparation only
• C. Detection, Containment
• D. Recovery and Lessons Learned

Answer: (A)

Understanding the malware incident response lifecycle is key here. The process starts with preparation, which sets up the people, tools, communication plans, and roles so you can respond quickly and consistently when an incident occurs. When an alert comes in, detection is the next step to identify that an incident is happening and determine its scope. Once you know what you’re dealing with, containment focuses on stopping the spread of the malware and limiting damage to other systems.

After containment, eradication removes the malware from affected environments and closes the vulnerabilities it exploited. Recovery then restores normal operations, validates that systems are clean and trustworthy, and ensures services are fully functional again. Finally, lessons learned capture what happened, assess the effectiveness of the response, and update policies and defenses to prevent a similar incident in the future.

This sequence includes all the necessary actions in the correct order. Other options leave out important phases or skip steps, such as focusing only on preparation, or only on detection and containment, or ending with recovery and lessons learned without addressing how the incident was detected, contained, and eradicated.