Select ALL activities described as Computer Security Incident Response Team (CSIRT) functions in the course material.

### Why this is right - **Preserving evidence during an investigation** supports forensic analysis and reliable incident findings. - **Coordinating containment and recovery** is part of structured incident handling. - **Communicating with legal and executive stakeholders** helps align technical action with organizational and reporting needs. - **Conducting post-incident lessons learned** turns findings into improvements. ### The concept A CSIRT is not limited to technical cleanup. Its role may span preparation, investigation, evidence handling, coordination, communication, recovery, and review. Team membership can include security, IT, legal, public relations, and compliance personnel. This cross-functional structure matters because incidents can affect operations, privacy duties, customers, and reputation. ### The other options - **Providing continuous alert monitoring as its only function**: Continuous monitoring is commonly a SOC function, and the CSIRT has a broader incident-handling role. ### Terms - **Forensics**: Systematic examination of digital evidence to understand activity and preserve findings. - **Evidence preservation**: Protecting collected information from alteration or loss. ### Remember CSIRT work combines technical response with investigation, coordination, communication, and learning.