The stage of the plan-protect response cycle that consumes the most time is ________.

• A. Planning
• B. Protection
• C. Response
• D. Each of the above consumes about the same amount of time

Answer: (B)

The stage that takes the most time is the protection phase. After planning, implementing defenses across the environment involves hardening systems, applying patches, configuring access controls, deploying security tools (firewalls, IDS/IPS, endpoint protection, encryption, monitoring), and establishing robust backup and recovery capabilities. These tasks are typically broad in scope, affect many assets, require cross-team coordination, change-management approvals, testing to avoid disrupting operations, and ongoing maintenance. All of that tends to unfold over a longer period than simply planning or responding to incidents. Planning sets objectives and strategies and can be completed relatively quickly, while responding to events is reactive and often constrained by the specifics of an incident, with playbooks helping to streamline the process.