What is the goal of incident response (IR)?

• A. Identify events that deviate from normal operations, contain disruptions, and resume operations quickly
• B. Eliminate all risks immediately
• C. Automate all security controls
• D. Replace human analysts

Answer: (A)

The goal of incident response is to manage and limit the impact of security incidents by quickly detecting abnormal activity, containing the disruption, and restoring normal operations. This means spotting events that deviate from how systems normally behave, taking steps to prevent further damage or spread, and getting services back online as fast as possible while keeping evidence available for review and improvement.

Why this approach fits best: it focuses on reducing harm and restoring functionality in a timely manner, which is the practical aim of incident response. It’s not about eliminating all risks instantly—that isn’t realistic in complex environments. It also isn’t about automating everything or replacing human analysts; those are means to support the response, not the fundamental objective.