The helpdesk reports increased calls from clients reporting spikes in malware infections on their
systems. Which of the following phases of incident response is MOST appropriate as a FIRST
response?

A.
Recovery

B.
Follow-up

C.
Validation

D.
Identification

E.
Eradication

F.
Containment

Explanation:
To be able to respond to the incident of malware infection you need to know what type of malware
was used since there are many types of malware around. This makes identification critical in this
case.