In the SP 800-61r3 model, which three CSF functions constitute incident response itself, as distinct from preparation?

Answer: B. Detect, Respond and Recover

SP 800-61r3 shows Govern, Identify and Protect as preparation activities that are broader risk management work supporting incident response, with incident response itself comprising Detect, Respond and Recover.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.1 Incident Response Life Cycle Model