Which phase of an incident is where response activities are near completion and recovery starts.

• A. Termination
• B. Initiation
• C. Containment
• D. Evaluation

Answer: (A)

Understanding the incident response lifecycle, termination is the point where the response work is wrapping up and recovery begins. By this stage, the urgent threats have been contained and eradicated, and the focus shifts to returning systems and services to normal operation. Recovery activities—restoring data, bringing systems back online, and validating that they’re functioning correctly—start as part of finalizing the incident response. Documentation, post-incident review planning, and lessons learned typically follow as you transition back to business as usual. The other options describe earlier steps (initiation starts the response, containment limits the spread) or later review activities (evaluation), so termination best fits the idea of near completion with recovery underway.