So far (Day 1~3) we've covered specific techniques: auto response pipelines, compromised instance isolation, credential revocation. Today we examine the framework that ties them together. No matter how sophisticated the tools, without a system for when, what, and who decides, incident response descends into chaos. The essence of IR (Incident Response) is structure that enables consistent decision-making amid pressure and uncertainty. The exam tests NIST IR phase definitions, AWS services' roles in each phase, and the critical boundary between what to automate and what to leave to human judgment.