The Chief Technical Officer (CTO) has tasked The Computer Emergency Response Team (CERT)
to develop and update all Internal Operating Procedures and Standard Operating Procedures
documentation in order to successfully respond to future incidents. Which of the following stages
of the Incident Handling process is the team working on?

A.
Lessons Learned

B.
Eradication

C.
Recovery

D.
Preparation

Explanation:
Incident response procedures involves: Preparation; Incident identification; Escalation and

notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First
responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss
control. Developing and updating all internal operating and standard operating procedures
documentation to handle future incidents is preparation.