Properly determining the scope of a security incident occurs during triage. Which of the following statements are true about the triage phase?
1) The triage phase is the first step in incident response.
2) Triage involves assessing the severity and impact of the incident.
3) During triage, the incident response team gathers evidence and collects information.
4) Triage is only necessary for large-scale security incidents.
5) The triage phase is conducted after the containment phase.