Which activities belong in the Prepare phase? Select ALL that apply.

### Why this is right - **Define response objectives and related policies and procedures** is correct because preparation lays out the response strategy and its supporting guidance. - **Establish reliable backups for data and systems** is correct because backups support restoration during an outage. - **Develop exercises to test the plan and response** is correct because exercise results can reveal improvements before a real incident. ### The concept Prepare concerns readiness before an incident is being handled. It includes objectives, policies, procedures, backups, update and patch strategies, and exercises. A lessons learned document is created after incident analysis, so it belongs with the Understand phase rather than preparation. ### The other options - **D. Write the lessons learned document after resolving an incident**: This is a post-incident learning activity associated with understanding and improving the response. ### Terms - **Backup**: A copy of data or systems kept so they can be restored if the originals become unavailable or unusable. ### Remember Prepare builds capability before an incident; Understand turns experience into later improvements.