Most Security+ questions about incident response don't test your understanding of what each phase is. Instead, they present a scenario and ask what should come next. If you have the steps memorized, the correct answer should logically fit into the situation. But if you just know the definitions, a few options might seem plausible, leaving you to guess.

Objective 4.8 outlines the process in seven steps: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. NIST SP 800-61 groups these into four phases, folding containment, eradication and recovery (the action steps) into one. Know both versions; either could be used, but the seven-step list helps spot the tricky options.

Find where the story is

Before you look at the options, read the situation and ask one thing: what has already happened? If the alert just went off and no one knows if it's real, you're in the detection or analysis phase.…