Which of the Following Best Describes the Detection and Analysis

Which of the following best describes the detection and analysis phase of the NIST incident response process?

A) Follows a predefined process while documenting each step the analyst takes
B) Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents
C) Includes how to use collected incident data and evidence retention
D) Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it