Which item is not typically part of an incident response playbook for network incidents?

Which item is not typically part of an incident response playbook for network incidents?

• A. Detection/Notification
• B. Containment
• C. Eradication
• D. Software development lifecycle

Answer: (D)

Incident response playbooks are structured to guide responders through steps when a network incident is detected, focusing on rapid detection and notification, containment to limit spread, and eradication to remove the threat and artifacts. After those actions, recovery brings systems back online, and a lessons-learned phase documents what happened to improve future responses. The software development lifecycle, while essential for building and maintaining secure software, is a separate process that governs how software is created—from planning and design through implementation and maintenance. It isn’t a standard component of an incident response playbook, though lessons from incidents can influence SDLC practices later. Therefore, the item that does not typically belong in an incident response playbook is the software development lifecycle.

Incident response playbooks are structured to guide responders through steps when a network incident is detected, focusing on rapid detection and notification, containment to limit spread, and eradication to remove the threat and artifacts. After those actions, recovery brings systems back online, and a lessons-learned phase documents what happened to improve future responses. The software development lifecycle, while essential for building and maintaining secure software, is a separate process that governs how software is created—from planning and design through implementation and maintenance. It isn’t a standard component of an incident response playbook, though lessons from incidents can influence SDLC practices later. Therefore, the item that does not typically belong in an incident response playbook is the software development lifecycle.