A cybersecurity incident at a Boston-based healthcare provider forced the response team into action.

The correct answer is A because the scenario spans the full lifecycle of incident handling rather than only one stage. It includes readiness and role assignment, communication, containment, eradication of the malicious code, recovery of services, and a later lessons-learned review. Microsoft’s incident-response guidance, aligned to NIST SP 800-61, describes the overall process as preparation, detection and analysis, containment with eradication and recovery, and post-incident activity. CHFI v11 similarly includes computer forensics as part of the incident response plan and an overview of incident response process flow. Because the question asks for the structured approach that best describes the complete method being followed, a single phase like Preparation, Post-Incident Activities, or Eradication would be too narrow. The team is clearly moving through multiple coordinated stages of one overall framework. In exam terms, when a scenario describes the entire progression from preparation through recovery and review, the correct answer is the overall incident response process flow, not one isolated sub-phase.