Exam SY0-601 topic 1 question 152 discussion

Answer: It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future. The final phase of the incident response is also called the lessons learned or remediation step. ======================= Phases of the Incident Response Plan: 1. Preparation - Preparing for an attack and how to respond 2. Identification - Identifying the threat 3. Containment - Containing the threat 4. Eradication - Removing the threat 5. Recovery - Recovering affected systems 6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident.

Yep, lessons learned. The answer it's A

A. It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.

The final phase of the incident response plan is crucial for evaluating the effectiveness of the response, identifying any weaknesses in the incident handling process, understanding the root cause of the incident, and implementing measures to prevent similar incidents in the future. It involves conducting a post-incident analysis and generating a comprehensive report with recommendations for improvement.

Remediation AKA lessons learned

I agree, the other steps were Identification, containment and recovery, It is A, lessons learned

'Lessons Learned'