CertNexus Certified Cyber Secure Coder (CSC) — Question 21

The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)

Answer options

• A. Providing a briefing to management
• B. Updating policies and procedures
• C. Training staff for future incidents
• D. Investigating responsible staff
• E. Drafting a recovery plan for the incident

Correct answer: B, E

Explanation

Updating policies and procedures (B) is essential to ensure that lessons learned from the incident are incorporated to prevent future occurrences. Drafting a recovery plan for the incident (E) is also critical to outline the steps needed to restore operations and mitigate the impact of the incident. The other options, while important, do not directly address the immediate next steps following root cause analysis.