[&] Why is triage an essential component of the detection and analysis phase?
- It eliminates the need for endpoint security
- It replaces the need for network firewalls
- It helps validate alert legitimacy and prioritize incidents -- Correct
- It automates all manual security tasks

[&] Which activity occurs during the event collection phase?
- Performing incident post-mortem
- Collecting raw telemetry from security tools -- Correct
- Developing new software
- Training staff on security protocols

[&] What is the significance of documenting findings during the detection and analysis phase?
- To sell data to third parties
- To create marketing material for the security team
- To ensure a seamless handoff to containment and eradication teams -- Correct
- To share personal opinions on response strategies