Which phase of the incident handling process is responsible for defining rules and creating a backup plan?

• A. Preparation phase
• B. Detection phase
• C. Eradication phase
• D. Recovery phase

Answer: (A)

Defining rules and creating a backup plan is part of the preparation phase. In preparation, you set up incident response policies, roles, escalation paths, and runbooks, and you establish continuity and disaster recovery plans so you can recover from incidents. The detection phase focuses on identifying incidents, the eradication phase on removing threats, and the recovery phase on restoring systems after containment. With solid preparation, the response activities that follow have predefined rules and a tested backup strategy to rely on.