Which option is not one of the five core steps of the incident response framework?

Which option is not one of the five core steps of the incident response framework?

• A. Escalate
• B. Identify
• C. Protect
• D. Recover

Answer: (A)

In incident response, you move through a defined set of phases: identify the incident, contain it to limit impact, eradicate the threat, recover affected systems, and then perform post-incident learning to improve. Escalation isn’t a named phase in that sequence; it’s a real-time action you might take to bring in more resources or leadership when the incident warrants it, but it isn’t one of the five core steps itself. That’s why escalation is the best answer for not belonging to the five core steps. For context, identifying and recovering are clearly part of the lifecycle, while protection sits outside the incident-response phases as preventive measures rather than a step you follow during an active incident.

In incident response, you move through a defined set of phases: identify the incident, contain it to limit impact, eradicate the threat, recover affected systems, and then perform post-incident learning to improve. Escalation isn’t a named phase in that sequence; it’s a real-time action you might take to bring in more resources or leadership when the incident warrants it, but it isn’t one of the five core steps itself. That’s why escalation is the best answer for not belonging to the five core steps.

For context, identifying and recovering are clearly part of the lifecycle, while protection sits outside the incident-response phases as preventive measures rather than a step you follow during an active incident.