A workstation is exhibiting symptoms of malware and the network security analyst has decided to remove
the system from the network. This represents which of the following stages of the Incident Handling
Response?

A.
Plan of action

B.
Mitigation

C.
Lesson Learned

D.
Recovery