After ransomware hits a county tax system, the IR lead must apply the lifecycle in the right order. Which sequence is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of IR like a fire drill you practice before the alarm, then find the fire, size it up, stop the spread, put it out, reopen the building, and write down what to fix. Preparation comes first so nobody invents a plan under ransomware pressure. Skipping containment before eradication is like mopping flames while they still jump to the next floor.
Full Explanation
The CompTIA-aligned incident response process moves through preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Preparation builds contacts, tools, and playbooks before an event. After detection and analysis confirm ransomware on the county tax system, responders contain spread, eradicate persistence, recover services, then capture lessons. Reordering those phases risks unfinished cleanup or premature restoration of infected systems.