Which lifecycle phase includes monitoring networks, systems, and connected devices to identify potential threats?

### Why this is right The Observe phase monitors networks, systems, and connected devices for potential threats. It also includes producing reports, documenting events, and analyzing observations to decide whether to activate the plan. ### The concept The four phases organize different kinds of response work. Prepare creates readiness before an incident. Observe looks for signs that an incident may be happening. Resolve contains and mitigates the threat, eradicates the intrusion, and supports restoration. Understand reviews causes and response performance so future plans can improve. ### The other options - **A. Prepare**: This phase establishes objectives, backup processes, patching strategies, and exercises before response is needed. - **C. Resolve**: This phase addresses and mitigates an identified incident rather than carrying out routine observation. - **D. Understand**: This phase reviews root cause, lessons, and improvements after response work. ### Terms - **Monitoring**: Observing networks, systems, or devices to identify potential threats or incidents. ### Remember Observe detects and assesses; Resolve acts to contain and recover.