How many phases in the attack lifecycle

Question

Assignment:

1. What constitutes an incident. Who in an organization should make that determination? Should it be one person, or a team?
2. How many phases in the attack lifecycle? Does attacks always flow through all of them in order? If not show an example of an attack that may flow back and forth.
3. What are the goals of Inc.ident response? Use a real-world example to demonstrate each goal.
4. Why is preparation for an incident important? Give a real-world example where proper preparation could have resulted in a better outcome.