A hospital SOC is still deciding whether a backup alert is an incident and is pulling related logs to make that decision. Which handling phase is underway?
Select an answer to reveal the explanation.
Short Explanation
Standing at the panel deciding whether the bell is a real incident, printout in hand, is the investigation itself. You have not confirmed the backup alert yet, and the team is pulling logs to decide. The trap is plan writing, restoring a host nobody has confirmed, or lessons for a case that is still open.
Full Explanation
Detection and analysis, while the team decides whether the backup alert is an incident is the phase underway. The SOC has an alert, has not yet decided that it is an incident, and is pulling logs to make that decision. Judging the alert and gathering the records that support or refute it is detection and analysis. Preparation of the incident plan, completed before any alert like this one is opened is work done to get ready before alerts of this kind are in front of the team. The hospital is not writing the plan right now; it is working a live alert. Recovery of a backup host that nobody has confirmed as affected by this alert yet restores a system. The stem says nobody has confirmed that a backup host is affected, so recovery would skip the decision the team is still making. Post-incident lessons recorded after a confirmed incident has already been closed and reviewed comes after a confirmed incident is closed. Lessons from a finished case do not describe an alert that is still being judged. Exam caveat: NIST SP 800-61 Rev. 3 maps detection and analysis onto CSF 2.0 Functions. Keep the exam's phase name for this log-pulling decision, and do not treat the four familiar names as Rev. 3's only model. Operational check: write down the working theory and the logs that support or refute it before anyone changes the backup system.