CAS-003 · Question #814
The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working condition, and all file integrity was verified. Which of the following should the…
The correct answer is A. Root cause analysis. After multiple servers crashed simultaneously for an unknown reason, and the immediate recovery is complete, the next step is Root Cause Analysis (RCA). RCA is a structured methodology to identify the underlying cause of an incident - not just the symptoms. Understanding WHY…
Question
The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working condition, and all file integrity was verified. Which of the following should the incident response team perform to understand the crash and prevent it in the future?
Options
- ARoot cause analysis
- BContinuity of operations plan
- CAfter-action report
- DLessons learned
How the community answered
(34 responses)- A91% (31)
- C6% (2)
- D3% (1)
Explanation
After multiple servers crashed simultaneously for an unknown reason, and the immediate recovery is complete, the next step is Root Cause Analysis (RCA). RCA is a structured methodology to identify the underlying cause of an incident - not just the symptoms. Understanding WHY the servers crashed is essential to implementing effective preventive controls. Without RCA, the same failure mode may recur. An after-action report (C) and lessons learned (D) are outputs that typically follow an RCA rather than replace it. A continuity of operations plan (B) is a preparedness document, not a post-incident investigative process. RCA directly fulfills the question's goal of understanding and preventing recurrence.
Topics
Community Discussion
No community discussion yet for this question.