In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?


A. Identification
B. Preparation
C. Lessons learned
D. Eradication
E. Recovery
F. Containment