Exam 212-89 topic 1 question 30 discussion

I noticed something interesting about this question. The CERT incident management process actually consists of four standard phases: Preparation Detection & Analysis Containment, Eradication & Recovery Post-Incident Activity/Lessons Learned Protection isn't a standard phase in this process. Infrastructure improvements typically come from the Lessons Learned phase and then get implemented during the next Preparation cycle. Since Lessons Learned isn't an option here, we might consider either: Preparation (as it's where improvements get implemented) or ask for clarification since the question includes a non-standard phase Would be interested to hear others' thoughts on this.

Lessons learnt which unfortunately is not listed among the options. In that case I will go for B as part of post-mortem improvement

there is no Protection step in the process

Is it A or B? After the incident for improvement doesnt you need prepare for likely risks especially with what you learned from last incident?