Kroll interview question

I was asked about incident response lifecycle