Match each incident response stage with its primary purpose.

### The pairs | Item | Matches | Why | |---|---|---| | Preparation | Establish plans, roles, training, and readiness | Preparation builds the capacity to respond before an incident happens. | | Detection and analysis | Recognize suspicious activity and determine its scope | Responders confirm what is happening, which assets are involved, and how severe it may be. | | Containment | Limit spread and impact | Isolation and access restrictions reduce further damage. | | Eradication | Remove the threat and its cause | Teams remove malicious code, persistence, and relevant weaknesses. | | Recovery | Restore and validate services and data | Systems return to operation only after restoration and checks. | | Post-incident activity | Document lessons and improve response | Review findings are used to update plans, controls, and training. | ### Terms - **Incident response**: A structured process for handling cybersecurity incidents. ### Remember The stages move from readiness to understanding, control, removal, restoration, and improvement.