[&] Which phase involves establishing policies and tools necessary for incident detection and response?
- Preparation -- Correct
- Post-Incident Activity
- Containment, Eradication, and Recovery
- Detection and Analysis

[&] What is the focus of the Post-Incident Activity phase?
- Learning from the incident to improve future responses -- Correct
- Establishing communication plans
- Recovering systems to normal operations
- Confirming legitimacy of potential incidents

[&] What is a key activity in the Detection and Analysis phase?
- Monitoring security systems for alerts -- Correct
- Conducting a post-incident review
- Isolating affected systems
- Creating incident response policies

[&] Why is the Post-Incident Activity phase important?
- It focuses on training employees about security awareness
- It focuses exclusively on restoring normal operations
- It updates plans and shares findings to enhance detection capabilities -- Correct
- It ensures the complete removal of threats

[&] Which of the following are the four main phases of the NIST SP 800-61 Incident Response Life Cycle?
- Preparation, Detection, Containment, Eradication & Recovery
- Detection, Preparation, Analysis, Containment Eradication & Recovery
- Preparation, Detection & Analysis, Containment Eradication & Recovery, Post-Incident Activity -- Correct
- Detection, Analysis, Recovery, Lessons Learned

[&] Which activity is NOT part of the Containment, Eradication, and Recovery phase?
- Eradicating threats by removing malware
- Triaging and categorizing alerts -- Correct
- Restoring data from backups
- Containing the threat by blocking traffic