Which incident response phase would include gathering and preserving any evidence?
Detection and analysis
Preparation
Containment, eradication, and recovery
Post-incident activity
Operations and Incident Response | |
Architecture and Design | |
Implementation | |
Governance, Risk, and Compliance | |
Attacks, Threats, and Vulnerabilities |