Which step does the NIST Incident Response Lifecycle begin with?

Sound the Alarm: Detection and Response | Weekly challenge 1 Quiz | 

Which step does the NIST Incident Response Lifecycle begin with?

• Post-Incident Activity
• Containment, Eradication and Recovery
• Detection and Analysis
• Preparation