An organization's computer incident response team $($CIRT$)$ receives an alert that shows possible malicious activity on a critical server within the network, and they initiate the CompTIA incident response process. The team follows the incident response lifecycle to address the situation, which involves several key steps. What order must the CIRT follow when performing the CompTIA incident response process?

a$.$

Detection, analysis, eradication, restoration, improvement

b$.$

Preparation, analysis, isolation, containment, recovery

c$.$

Isolation, analysis, restoration, eradication, improvement

d$.$

Detection, analysis, containment, eradication, recovery