The identified security incidents are analyzed, validated, categorized, and prioritized; the IH&R team further analyzes the compromised device to find incident details such as the type of attack, its severity, target, impact, and method of propagation, and any vulnerabilities it exploited. Which term best describes this activity?

The identified security incidents are analyzed, validated, categorized, and prioritized; the IH&R team further analyzes the compromised device to find incident details such as the type of attack, its severity, target, impact, and method of propagation, and any vulnerabilities it exploited. Which term best describes this activity?

• A. Incident triage
• B. Eradication Phase
• C. Classification
• D. Regression

Answer: (A)

The main idea is prioritizing and validating security events to determine how to respond. In incident response, triage is the stage where incoming incidents are checked for validity, analyzed, categorized, and ranked by urgency and potential impact. The described activity fits this because the team is confirming the incident, digging for details (attack type, severity, target, impact, propagation method, and exploited vulnerabilities), and then prioritizing what to tackle first. This quick, structured assessment guides what needs immediate containment and what can wait, and it sets the stage for the next steps in the response. Eradication comes after triage and focuses on removing the attacker and cleaning up remnants from affected systems. Classification is part of triage—labeling the incident by type—but triage goes beyond labeling by also prioritizing and outlining next actions. Regression is not relevant to incident handling; it refers to a software testing concept unrelated to incident response.

The main idea is prioritizing and validating security events to determine how to respond. In incident response, triage is the stage where incoming incidents are checked for validity, analyzed, categorized, and ranked by urgency and potential impact. The described activity fits this because the team is confirming the incident, digging for details (attack type, severity, target, impact, propagation method, and exploited vulnerabilities), and then prioritizing what to tackle first. This quick, structured assessment guides what needs immediate containment and what can wait, and it sets the stage for the next steps in the response.

Eradication comes after triage and focuses on removing the attacker and cleaning up remnants from affected systems. Classification is part of triage—labeling the incident by type—but triage goes beyond labeling by also prioritizing and outlining next actions. Regression is not relevant to incident handling; it refers to a software testing concept unrelated to incident response.