What is not mentioned as a phase of an incident response?
A.
Documentation
B.
Prosecution
C.
Containment
D.
Investigation
Explanation:
B: The incident response and handling phase can be broken down further into triage, investigation, containment, and analysis and tracking. Page 523.
Although documentation is essential and should take place, it is not defined as a typical phase. So, answer A is also correct.