A team observes unusual activity. Explain how it should decide whether to activate the response plan and what it should do during the Resolve phase if an incident is confirmed.

### The concept Observation does not mean every event is automatically an incident. The team documents and analyzes occurrences to decide whether the response plan should be activated. If it is activated, Resolve begins with understanding the issue so the team can contain the threat and choose suitable mitigation. Disabling connectivity or isolating systems may limit further harm, but the action depends on the circumstances. Responders then work to eradicate the intrusion, restore from backups where appropriate, scan devices, patch vulnerabilities, and preserve evidence and records. ### What a good answer covers - Documents and analyzes the activity before deciding whether to activate the plan. - Describes containment and proportionate mitigation after confirmation. - Includes eradication, restoration, scanning, or patching as relevant response work. - Preserves evidence and supporting documentation during the response. ### Terms - **Containment**: Actions that limit an incident's spread or prevent further damage. - **Isolation**: Separating systems or devices from other connections to limit an active threat. ### Remember Analyze observations first, then contain and resolve confirmed incidents while preserving records.