which of the following phases of the Incident Response process should a security administrator define and implement general defense against malware?

During which of the following phases of the Incident Response process should a security
administrator define and implement general defense against malware?

A.
Lessons Learned

B.
Preparation