The identified security incidents are analyzed, validated, categorized, and prioritized; the IH&R team further analyzes the compromised device to find incident details such as the type of attack, its severity, target, impact, and method of propagation. What is this step?

• A. Classification
• B. Incident triage
• C. Unsupervised Learning
• D. Regression

Answer: (B)

Incident triage is the rapid assessment and prioritization of security incidents. It involves validating that incidents are real, categorizing them, and ranking them by severity and urgency so responders know where to focus first. The described activity goes further by digging into the compromised device to identify details like the type of attack, its severity, target, impact, and how it propagated, which information then guides containment and remediation actions. That combination of validation, categorization, prioritization, and detailed incident profiling to direct the response is exactly what incident triage covers. Classification would stop at labeling incidents into categories without prioritization or action guidance, while unsupervised learning and regression are machine learning techniques, not the operational step described.