Exam CS0-002 topic 1 question 159 discussion

Incident communication process should include legal department as well.

Now I understand the answering being A - the question is saying this incident is occurring so the security should consult with legal next. If the incident just occurred or been discovered, then the next steps should be to follow the incident communications plan

I see this as B. remember the incident response procedures. They've determined an incident has taken place (Detection and Analysis). The next phase is containment which is limit the scope and magnitude of the incident

D positively Per CompTIA's study guide, including legal representatives should be part of the communications plan.

Definitely D

I think D is the best choice, wouldn't the incident communications process include contacting the legal department?

D. Communication with law enforcement and then affected customers

lawyers should be consulted if an incident involves sensitive data (personally identifiable information, protected health information, payment card data, etc.) or could otherwise subject the company to liability. Accordingly, an effective incident response plan addresses the nuts and bolts of handling ordinary incidents, but also has well-defined triggers of when Legal should be called and how the legal team will interact with the rest of the response unit. That way, it is much less likely that someone says, “hey, maybe we should call Legal” too late in the process.