In this step, your main objective is to examine and analyze what has occurred and focus on determining the root cause of the incident.
Recovery is incorrect as recovery is about resuming operations or bringing affected systems back into production
Containment is incorrect as containment is about reducing the potential impact of an incident.
Triage is incorrect as triage is about determining the seriousness of the incident and filtering out false positives
Reference:
Official Guide to the CISSP CBK, pages 700-704

Malfeasance by computer is an act involving a computer that is technically and ethically improper, but may or may not be illegal. Some of these activities may not be considered illegal by the user and may be unintentional. Examples of such behavior are: Using a password that you have been given by someone else to have access to their computer and using that password to view files that were not intended for your perusal Giving a copy of a software package that you purchased to a member of your family for personal use (In most instances, this is illegal based on software licenses.) Using the computer at your place of employment to store some information related to an outside business activity Answers a, b, and d are valid categories of computer crime. The fourth category is a crime where the computer is incidental to other crimes. Examples in these four categories are: The computer is a target of the crime. Sabotage or theft of intellectual property, disruption of business operations, illegal access to government and personal information, and falsifying or changing records. Crimes using the computer. Theft of money from financial accounts, credit card fraud, fraud involving stock transfers, billing charges illegally to another party, and telecommunications fraud. Crimes associated with the prevalence of computers. Violation of copyright restrictions on commercial software packages, software piracy and software counterfeiting. The computer is incidental to other crimes. (In this category, the crime could be committed without the computer, but the computer permits the crime to be committed more efficiently and in higher volume.) Money laundering, keeping records and books of illegal activity and illegal gambling.

Explanation/Reference:
Explanation:
The Bell-LaPadula model focuses on preventing information from flowing from a high security level to a low security level. Information Flow Model deals with covert channels.
Subjects can access files. Processes can access memory segments. When data are moved from the hard drive's swap space into memory, information flows. Data are moved into and out of registers on a CPU.
Data are moved into different cache memory storage devices. Data are written to the hard drive, thumb drive, CD-ROM drive, and so on. Properly controlling all of these ways of how information flows can be a very complex task. This is why the information flow model exists-to help architects and developers make sure their software does not allow information to flow in a way that can put the system or data in danger.
One way that the information flow model provides this type of protection is by ensuring that covert channels do not exist in the code.
Incorrect Answers:
B: The Bell LaPadula model on its own is not sufficient because it does not deal with the identification of covert channels.
C: The Biba model is an integrity model. It will not prevent information from flowing from a high security level to a low security level or identify covert channels.
D: The Information Flow model on its own is not sufficient because it will not prevent information from flowing from a high security level to a low security level.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, pp. 377-378

Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide:
Mastering the Ten Domains of Computer Security, pages 231, 348. Marking, handling and storage are all media viability controls used to protect the viability of data storage media.