Which of the following incident response phases should the proper collection of the detected IoCs and
establishment of a chain of custody be performed before?


A. Containment
B. Identification
C. Preparation
D. Recovery