Which component is typically initiated when anomalous activity is detected, triggering the incident response process?

• A. Containment
• B. Analysis
• C. Eradication
• D. Detection

Answer: (D)

Detection is what starts the incident response. Monitoring tools, logs, and security sensors look for unusual or unauthorized activity and generate alerts when something suspicious is observed. That alert signals that an incident may be unfolding and triggers the incident response process to begin. From there, analysts triage and analyze the potential incident to determine scope and impact, then proceed to containment to limit damage, eradication to remove the threat, and recovery to restore normal operations. Without detection, there’s no trigger to start the response, which is why detection is the initiating component.