Exam CS0-003 topic 1 question 59 discussion

Actual exam question from CompTIA's CS0-003

Question #: 59
Topic #: 1

An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?

A. To satisfy regulatory requirements for incident reporting
B. To hold other departments accountable
C. To identify areas of improvement in the incident response process
D. To highlight the notable practices of the organization's incident response team

Show Suggested Answer

Suggested Answer: C 🗳️

by nmap_king_22 at Sept. 5, 2023, 4:20 a.m.

Comments

Submit Cancel

kmordalv

11 months, 1 week ago

Selected Answer: C

It seems the most logical answer

upvoted 2 times

...

nmap_king_22

11 months, 2 weeks ago

Selected Answer: C

The most likely reason to include lessons learned in an after-action report following a significant security incident is: C. To identify areas of improvement in the incident response process. Explanation: Lessons learned are a critical component of the incident response process. They serve the purpose of reflecting on what went well and what could have been done better during the incident response.

upvoted 3 times

...