Which activity is considered part of incident response?

• A. Detection, investigation, and forensic evidence integrity
• B. Product pricing optimization
• C. Hiring decisions for IT staff
• D. Public relations planning

Answer: (A)

Incident response focuses on how an organization detects, analyzes, contains, eradicates, and recovers from cybersecurity incidents, with careful attention to preserving evidence for investigations. The activity described—detection, investigation, and maintaining the integrity of forensic evidence—matches these core functions. Detection triggers the incident response process; investigation clarifies scope and impact; ensuring forensic evidence integrity (including maintaining a proper chain of custody and preventing tampering) ensures that data collected during an incident can be relied upon for investigations, post-incident analysis, and potential legal action.

The other options fall outside incident response: product pricing optimization is a business strategy activity, IT staffing decisions pertain to HR/resource planning, and public relations planning relates to communications and reputation management. While communications may occur during an incident, the primary incident response tasks are detection, analysis, containment, eradication, and recovery, all of which are captured by the described activities.