Arrange the following incident response lifecycle phases in chronological order from earliest to latest: Resolve, Prepare, Understand, Observe.

### The order 1. **Prepare**: Define objectives and establish backups, patching strategies, and exercises before an incident response is needed. 2. **Observe**: Monitor and analyze events to identify potential incidents and decide whether to activate the plan. 3. **Resolve**: Contain and mitigate the threat, eradicate the intrusion, and support restoration. 4. **Understand**: Identify root cause, review response performance, and record lessons for future improvement. ### The concept The lifecycle moves from readiness to detection, active response, and learning. The final review feeds improvements back into future preparation. Although the phases are listed in a sequence, organizations may need to revisit actions as an incident develops; the sequence describes the plan's organizing structure. ### The other options The listed items are phase names rather than answer choices, so each is used once in the sequence above. ### Terms - **Incident response lifecycle**: The set of phases used to organize preparation, observation, resolution, and post-incident learning. ### Remember The sequence is Prepare, Observe, Resolve, Understand.