SY0-701 · Question #938
SY0-701 Question #938: Real Exam Question with Answer & Explanation
The correct answer is C: Lessons learned. The lessons learned phase occurs after an incident is resolved and involves reviewing the response process, identifying improvements, and implementing changes to enhance future incident handling.
Question
A manager meets with various stakeholders involved with a recently resolved security incident. During the meeting, they discuss potential improvements to the environment in order to better respond to future incidents. Which of the following incident response activities does this describe?
Options
- ARecovery
- BAnalysis
- CLessons learned
- DContainment
Explanation
The lessons learned phase occurs after an incident is resolved and involves reviewing the response process, identifying improvements, and implementing changes to enhance future incident handling.
Community Discussion
No community discussion yet for this question.