Exam CS0-003 topic 1 question 59 discussion

C and D are good answer choices. But the lessons learned is most often aligned with asking "What went wrong? How can we learn from this to improve?" Answer is C

It seems the most logical answer

The most likely reason to include lessons learned in an after-action report following a significant security incident is: C. To identify areas of improvement in the incident response process. Explanation: Lessons learned are a critical component of the incident response process. They serve the purpose of reflecting on what went well and what could have been done better during the incident response.