Which activity is associated with monitoring and investigation in security operations?

Which activity is associated with monitoring and investigation in security operations?

• A. Preparation and Prevention
• B. Response
• C. Monitoring and Investigation
• D. Recovery

Answer: (C)

Continuous observation of systems and networks, collecting data from logs and alerts, and analyzing it to understand what happened is the core here. This activity focuses on detecting events, triaging alerts, and performing investigations to determine impact, scope, and root cause, so that the right actions can be taken quickly. It acts as the bridge between sensing threats and taking action, guiding containment, remediation, and next steps. The other phases serve different purposes: preparation and prevention build defenses before incidents occur, response is about containing and eliminating threats during an incident, and recovery focuses on restoring services and learning from the event afterward.

Continuous observation of systems and networks, collecting data from logs and alerts, and analyzing it to understand what happened is the core here. This activity focuses on detecting events, triaging alerts, and performing investigations to determine impact, scope, and root cause, so that the right actions can be taken quickly. It acts as the bridge between sensing threats and taking action, guiding containment, remediation, and next steps. The other phases serve different purposes: preparation and prevention build defenses before incidents occur, response is about containing and eliminating threats during an incident, and recovery focuses on restoring services and learning from the event afterward.