Explanation (preparation phase):

This is classic preparation work aimed at improving detection and response speed. Valid incident handling begins before incidents occur: ensuring telemetry exists, logs are collected centrally, alerts are actionable, and roles are defined so handoffs and escalation happen quickly. Reviewing firewall and IDS/IPS logging, centralizing alerts, and aligning the response team on responsibilities directly supports monitoring readiness and operational coordination.

(A) backup hardening is about recovery resilience and integrity of backups; nothing in the scenario references backup configurations or restore testing. (B) law enforcement coordination is a procedural/legal readiness task, not what is described. (C) vulnerability scanning is proactive identification of weaknesses; again, the actions here are about log visibility and alerting, not scanning.

Network monitoring readiness (D) best fits because it includes: ensuring the right data sources are logging, time synchronization, centralized collection (SIEM/log platform), and defined responsibilities for triage and escalation. This aligns with playbook-style preparation models that emphasize roles and monitoring visibility before incidents occur .