Which of the following is not a standard stage in the incident response lifecycle?

• A. Recovery
• B. Preparation
• C. Containment
• D. Backup

Answer: (D)

This question tests understanding of which activities are part of the incident response lifecycle versus separate data protection tasks. In incident response, teams move through phases like preparation, detection/identification, containment, eradication, recovery, and post-incident review, each with a specific objective to control the incident and restore operations. A backup is a data protection practice used to restore data after loss or compromise, but it isn’t itself a step in the incident response sequence. It supports recovery, but it isn’t a designated phase of handling the incident. So, while backups are essential for getting systems and data back, they are not considered a standard stage in the incident response lifecycle.