Match each incident response phase to its primary objective: Phases: 1. Containment 2. Eradication 3. Recovery 4. Post-Incident Activity Objectives: A. Restore systems to normal operation and monitor for recurrence B. Document lessons learned and update defensive procedures C. Isolate affected systems to prevent the incident from spreading D. Eliminate malware, compromised accounts, and root causes from the environment

### The pairs | Item | Matches | Why | |---|---|---| | Containment | Limit spread and preserve information for analysis | Isolation prevents continued spread while data supports investigation. | | Eradication | Remove the root cause and repair affected systems | This stage eliminates the intrusion's cause and cleans systems. | | Recovery | Restore, validate, and monitor systems | Recovery returns systems to operation and checks for recurrence. | | Post-incident activity | Review lessons and update the playbook | Review turns experience into improvements for future response. | ### Remember Contain, remove, restore, then learn.