Which of the following is one of the six steps of incident response?

• A. Detection
• B. Response
• C. Recover
• D. Review

Answer: (D)

Incident response runs through a sequence of stages, and finishing with a post-incident review is how teams turn experience into real improvement. The Review (often called Lessons Learned) step is where you look back at what happened, evaluate how effective your detection, containment, eradication, and recovery efforts were, quantify impact, and identify concrete changes to processes, tools, and training. This closes the loop and feeds updates into future preparation and detection capabilities, making it a distinct, named part of the six-step model.

Detection and analysis occur early in identify-related activities, guiding what to contain and eradicate, while recovery focuses on restoring services. But the final, explicit step designed to capture insights and drive improvement is the Review, which is why it’s the best choice.