Certificate of Cloud Security Knowledge (CCSK) — Question 188

Which phase of the incident response lifecycle includes creating and validating alerts?

Answer options

• A. Preparation
• B. Containment, Eradication, Recovery
• C. Detection & Analysis
• D. Auditing & Logging
• E. Post-mortem

Correct answer: C

Explanation

The correct answer is C, as the Detection & Analysis phase focuses on identifying incidents and validating alerts related to potential security threats. The other options pertain to different aspects of the incident response process, such as preparation and post-incident review, which do not specifically involve alert creation and validation.