312-39V2: Certified SOC Analyst v2

James Rodriguez has recently assumed the role of lead SOC manager at GlobalTech Dynamics, a Fortune 500 company facing a growing cyber-threat landscape. She is responsible for enhancing the SOC’s ability to protect the organization’s critical assets. Her team is currently deploying a $2M state-of-the-art SOC facility, developing detailed incident-response playbooks, conducting tabletop exercises that simulate real-world attacks, and training a 15-member incident-response team to manage alerts and incidents efficiently. Within the Incident Response Process Flow, which phase most closely aligns with these activities?