What is the recovery phase of incident response?

• A.Identifying the attacker's entry point, collecting forensic images, interviewing the personnel involved, and reporting the timeline of events to the acquiring bank and the card brands
• B.Restoring affected systems to normal operation, verifying system integrity, and confirming that the vulnerability exploited has been addressed before returning systems to production
• C.Containing the affected hosts, blocking attacker addresses, disabling compromised accounts, and notifying the card brands
• D.Reviewing the incident with the response team, recording lessons learned, updating the plan, and scheduling the next exercise