What term describes the actions taken to handle an incident during and after it occurs?

• A. Incident response
• B. Disaster recovery
• C. Business continuity
• D. Forensics

Answer: (A)

Handling an incident during and after it occurs is described by incident response. This field covers the full lifecycle of dealing with a security event—from detecting and containing the incident to eradicating the threat, recovering normal operations, and conducting a post-incident review to prevent recurrence. Disaster recovery is more about restoring IT systems after a major disruption, and business continuity focuses on maintaining essential operations during disruption. Forensics involves investigating the incident to determine what happened and gather evidence. In practice, incident response teams might isolate affected machines to stop spread, remove malware, restore services from clean backups, and perform a lessons-learned analysis to bolster defenses.