Match each phase of the incident response lifecycle to its primary activity: Lifecycle Phases: 1. Prepare 2. Observe 3. Resolve 4. Understand Activities: A. Monitor and analyze system events and potential security incidents B. Contain, mitigate, eradicate active threats, and support system restoration C. Establish objectives, maintain backups, define patching strategies, and conduct exercises D. Identify root causes, review response performance, and document lessons learned

### The pairs | Item | Matches | Why | |---|---|---| | Prepare | Set objectives, backups, patching strategy, and exercises | Preparation establishes readiness and tests whether the response plan can work. | | Observe | Monitor and analyze events and potential incidents | Observation identifies possible threats and informs whether plan activation is needed. | | Resolve | Contain, mitigate, eradicate, and support restoration | Resolution addresses the active threat and works toward restoring affected systems. | | Understand | Identify root cause, review performance, and document lessons | Understanding examines what caused the incident and what should improve next time. | ### The concept The lifecycle distinguishes readiness, detection, active response, and learning. These phases are connected: preparation supports observation and action, while lessons from understanding should improve future preparation. The labels describe the main focus of each phase, not a reason to omit other relevant response activities such as documentation. ### Terms - **Root cause**: The underlying reason an incident occurred or succeeded. ### Remember Prepare, Observe, Resolve, and Understand move from readiness to detection, response, and improvement.