In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.

### Why this is right The exercise labels the phase that analyzes the breach and examines the unauthorized access incident as investigation. The personal-laptop event is new evidence to examine after the initial incident has been identified. ### The concept Discovery identifies the initial report and the systems and data that may be involved. Investigation then analyzes activity, alerts, logs, and possible control violations. Response focuses on coordinated decisions and communications, while recovery and compliance review consider audit readiness and longer-term improvements. These labels help participants organize decisions and avoid treating an initial report as a complete account of what happened. ### Terms - **Investigation**: The phase in which participants analyze the incident and examine relevant activity and evidence. - **Logging**: Recording system or user activity so it can be reviewed. ### Remember Suspicious activity is examined during investigation, after discovery has identified the incident.