Planning, protection, and response follow a fairly strict sequence from one stage to another.

• A. True
• B. False
• C. Not sure
• D. Unknown

Answer: (B)

False — these activities are not strictly sequential; they are iterative and often overlap. In real-world incident handling, planning and protective measures run continuously and are updated as threats are detected and analyzed. When an incident occurs, teams may adjust plans, strengthen protections, and proceed with containment, eradication, and recovery in cycles rather than a fixed, one-way order. Frameworks like the incident response lifecycle show stages such as preparation, detection/analysis, containment, eradication, recovery, and post-incident review, but emphasize returning to earlier activities as needed rather than following a rigid line.