nerdexam
CompTIA

SY0-501 · Question #334

A security analyst notices anomalous activity coming from several workstations in the organizations. Upon identifying and containing the issue, which of the following should the security analyst do…

The correct answer is D. Document findings and processes in the after-action and lessons learned report. After identifying and containing a security incident, the next crucial step in the incident response lifecycle is to document all findings and processes to create an after-action report and capture lessons learned.

Submitted by javi_es· Mar 4, 2026Security operations

Question

A security analyst notices anomalous activity coming from several workstations in the organizations. Upon identifying and containing the issue, which of the following should the security analyst do NEXT?

Options

  • ADocument and lock the workstations in a secure area to establish chain of custody
  • BNotify the IT department that the workstations are to be reimaged and the data restored for
  • CNotify the IT department that the workstations may be reconnected to the network for the
  • DDocument findings and processes in the after-action and lessons learned report

How the community answered

(44 responses)
  • A
    9% (4)
  • B
    2% (1)
  • C
    5% (2)
  • D
    84% (37)

Why each option

After identifying and containing a security incident, the next crucial step in the incident response lifecycle is to document all findings and processes to create an after-action report and capture lessons learned.

ADocument and lock the workstations in a secure area to establish chain of custody

Documenting and securing workstations for chain of custody is typically performed during the identification and containment phases to preserve evidence, not as the next step *after* containment is complete.

BNotify the IT department that the workstations are to be reimaged and the data restored for

Reimaging workstations and restoring data are part of the eradication and recovery phases, which occur after containment but prior to the finalization of the after-action report, which covers the entire incident.

CNotify the IT department that the workstations may be reconnected to the network for the

Reconnecting workstations to the network is a recovery activity that should only happen after eradication, validation, and ensuring systems are completely clean and secure, making it a later step in the incident response process.

DDocument findings and processes in the after-action and lessons learned reportCorrect

Documenting findings and processes in an after-action and lessons learned report is a critical component of the post-incident phase of the incident response lifecycle. This step ensures a thorough review of the incident, identifies areas for improvement in security posture and response procedures, and contributes to organizational learning for future incident prevention and handling.

Concept tested: Incident Response Lifecycle: Post-Incident Activities

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/incident-response-overview#incident-response-phases

Topics

#incident response#after-action report#lessons learned#IR lifecycle

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice