nerdexam
CompTIA

CAS-002 · Question #361

A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame as to whose fault it was that the…

The correct answer is B. During the Lessons Learned phase. The Lessons Learned phase of incident response is the appropriate stage to review the incident constructively, address accountability, and identify process improvements.

Enterprise Security

Question

A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame as to whose fault it was that the incident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner?

Options

  • ADuring the Identification Phase
  • BDuring the Lessons Learned phase
  • CDuring the Containment Phase
  • DDuring the Preparation Phase

How the community answered

(33 responses)
  • A
    6% (2)
  • B
    88% (29)
  • C
    3% (1)
  • D
    3% (1)

Why each option

The Lessons Learned phase of incident response is the appropriate stage to review the incident constructively, address accountability, and identify process improvements.

ADuring the Identification Phase

The Identification phase focuses on detecting and confirming that an incident is occurring, not on retrospective accountability discussions.

BDuring the Lessons Learned phaseCorrect

The Lessons Learned phase, also known as Post-Incident Activity, takes place after the incident is fully resolved and is specifically designed for a structured retrospective review. It allows teams to document findings, discuss accountability questions in a controlled environment, and define corrective actions. NIST SP 800-61r2 identifies this as the phase for reviewing the incident response process and improving future responses.

CDuring the Containment Phase

The Containment phase is focused on limiting the active spread and impact of the incident, not on post-incident analysis or blame resolution.

DDuring the Preparation Phase

The Preparation phase occurs before any incident to establish policies and response capabilities, making it irrelevant for addressing blame from a past breach.

Concept tested: Incident response Lessons Learned phase purpose and scope

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#incident response#lessons learned#breach response#IR phases

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice