dan is designing a segmented network that places systems with different levels of security requirements into different subnets with firewalls and other network security devices between them. in which phase of the incident response process is dan working in the given scenario?